Deploy Claude Desktop on 3P with an LLM gateway changedthird-party/claude-desktop/gateway
Nearest release: v2.1.315, published 3 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 30 Oct 2026 17:36 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 30 Oct 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+17added
Lines−17removed
From line
220
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits48to this page, all time
The whole hunk
from line 220, old and new numbered
/
from line 220
220220>
221221> * Use inferenceIdpAuthFlow together with inferenceIdpOidc once every desktop in the fleet is on a release that reads them. The original spelling will keep working; no end date has been set.
222222
223> **More detail**
223> [accordion] More detail
224224>
225225> * **`browser`:** register the redirect URI `http://127.0.0.1:<port>/callback` with your identity provider (for Entra, `http://127.0.0.1/callback`).
226226> * **`broker`:** uses Web Account Manager on Windows or Company Portal on macOS, and does not work on Linux. It can satisfy Conditional Access policies that require a compliant or managed device, or token protection.
from line 245
245245>
246246> * Use inferenceIdpOidc with inferenceCredentialKind: "external-idp" once every desktop in the fleet is on a release that reads them. The original spelling will keep working; no end date has been set.
247247
248> **More detail**
248> [accordion] More detail
249249>
250250> Used with `inferenceCredentialKind` set to `interactive`. Leave it unset for a gateway that runs its own sign-in and serves `<baseUrl>/.well-known/oauth-authorization-server`.
251251>
from line 253
253253>
254254> Register the redirect URI given under `inferenceGatewayOidcAuthFlow`.
255255
256> **Child attributes (11)**
256> [accordion] Child attributes (11)
257257>
258258> **clientId** `string` *required*
259259>
from line 277
277277>
278278> One of: `id_token` (default), `access_token`
279279>
280> > **More detail**
280> > [accordion] More detail
281281> >
282282> > An ID token's audience (`aud`) is `clientId`. An access token's audience must be your gateway or proxy.
283283> >
from line 287
287287>
288288> Space-separated scopes. Access-token mode needs the gateway or proxy API scope, and adds offline\_access unless Append offline\_access is off.
289289>
290> > **More detail**
290> > [accordion] More detail
291291> >
292292> > In ID-token mode, `offline_access` is not added to scopes that you set. Include it yourself, or users sign in again each time the token expires.
293293>
from line 295
295295>
296296> In access-token mode, add offline\_access to scopes so the identity provider returns a refresh token for silent refresh.
297297>
298> > **More detail**
298> > [accordion] More detail
299299> >
300300> > Turn off only if your authorization server rejects `offline_access` as an unknown scope. Then add the server’s own refresh-token scope to `scopes`.
301301>
from line 303
303303>
304304> Access-token audience of the gateway or proxy: an https URL or an AD FS relying-party identifier. Leave unset for Entra ID.
305305>
306> > **More detail**
306> > [accordion] More detail
307307> >
308308> > Use it only with `bearerTokenType` set to `access_token`, and only if your identity provider supports RFC 8707. Changing it signs users in again.
309309> >
from line 323
323323>
324324> Space-separated hostnames also accepted as the referrer of the sign-in callback, besides the authorization URL’s host.
325325>
326> > **More detail**
326> > [accordion] More detail
327327> >
328328> > If a callback is rejected for a referrer mismatch, the app log names the rejected host. Add that hostname here.
329329
from line 337
337337
338338One of: `browser`, `broker`
339339
340> **More detail**
340> [accordion] More detail
341341>
342342> * **`browser`:** register the redirect URI `http://127.0.0.1:<port>/callback` with your identity provider (for Entra, `http://127.0.0.1/callback`).
343343> * **`broker`:** uses Web Account Manager on Windows or Company Portal on macOS, and does not work on Linux. It can satisfy Conditional Access policies that require a compliant or managed device, or token protection.
from line 356
356356
357357**Identity provider (OIDC).** Your organization’s OpenID Connect identity provider. The user’s token is sent as the Bearer credential to the gateway or the Bedrock proxy.
358358
359> **More detail**
359> [accordion] More detail
360360>
361361> Used when `inferenceCredentialKind` is `external-idp`. Register the redirect URI given under `inferenceIdpAuthFlow` with your identity provider.
362362>
from line 364
364364>
365365> On Bedrock, set `inferenceBedrockBaseUrl` to a proxy that checks the token, because Amazon Bedrock itself does not accept it. Also list your models in `inferenceModels`.
366366
367> **Child attributes (11)**
367> [accordion] Child attributes (11)
368368>
369369> **clientId** `string` *required*
370370>
from line 388
388388>
389389> One of: `id_token` (default), `access_token`
390390>
391> > **More detail**
391> > [accordion] More detail
392392> >
393393> > An ID token's audience (`aud`) is `clientId`. An access token's audience must be your gateway or proxy.
394394> >
from line 398
398398>
399399> Space-separated scopes. Access-token mode needs the gateway or proxy API scope, and adds offline\_access unless Append offline\_access is off.
400400>
401> > **More detail**
401> > [accordion] More detail
402402> >
403403> > In ID-token mode, `offline_access` is not added to scopes that you set. Include it yourself, or users sign in again each time the token expires.
404404>
from line 406
406406>
407407> In access-token mode, add offline\_access to scopes so the identity provider returns a refresh token for silent refresh.
408408>
409> > **More detail**
409> > [accordion] More detail
410410> >
411411> > Turn off only if your authorization server rejects `offline_access` as an unknown scope. Then add the server’s own refresh-token scope to `scopes`.
412412>
from line 414
414414>
415415> Access-token audience of the gateway or proxy: an https URL or an AD FS relying-party identifier. Leave unset for Entra ID.
416416>
417> > **More detail**
417> > [accordion] More detail
418418> >
419419> > Use it only with `bearerTokenType` set to `access_token`, and only if your identity provider supports RFC 8707. Changing it signs users in again.
420420> >
from line 434
434434>
435435> Space-separated hostnames also accepted as the referrer of the sign-in callback, besides the authorization URL’s host.
436436>
437> > **More detail**
437> > [accordion] More detail
438438> >
439439> > If a callback is rejected for a referrer mismatch, the app log names the rejected host. Add that hostname here.
440440
from line 446
446446
447447**Stream idle timeout.** Extra seconds to wait for model output on a streaming response that is sending only keep-alive pings. Gateway provider only. Default 300.
448448
449> **More detail**
449> [accordion] More detail
450450>
451451> With pings arriving (SSE `ping` events or `:` comment lines), sessions accept at least about five minutes of them, then wait this many seconds more. With no pings, a silent response still fails after about 5 minutes whatever this value, so make the gateway send them.
452452>
No line in this hunk matches that.