Telemetry and egress changedthird-party/claude-desktop/telemetry
Nearest release: v2.1.319, published 14 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 6 Nov 2026 15:40 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 6 Nov 2026 16:07 UTC.
Upstream edited
Recorded here
Lines+8added
Lines−3removed
From line
62
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits51to this page, all time
The whole hunk
from line 62, old and new numbered
/
from line 62
6262
6363The export carries logs and metrics. Cowork sessions, Code sessions, and the desktop application's own events arrive under the `service.name` values `cowork`, `claude-code-desktop`, and `claude-desktop` respectively. With [Unified Claude](https://claude.com/docs/third-party/claude-desktop/unified-claude.md) on, a Cowork session started from the home screen also arrives under `cowork`. The export isn't checked against the [agent egress allowlist](#required-egress-paths), so `otlpEndpoint` doesn't need an entry in `coworkEgressAllowedHosts`; your perimeter firewall still needs to allow the host.
6464
65For collector authentication headers, extra resource attributes, and the log level of the desktop application's own event stream, see [`otlpHeaders`, `otlpResourceAttributes`, and `otlpDesktopLogLevel`](https://claude.com/docs/third-party/claude-desktop/configuration#otlpheaders) in the configuration reference. Events on the `claude-desktop` stream include `desktop_ssh_sandbox_check_failed`, described under [Sandbox status on the remote host](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md#sandbox-status-on-the-remote-host), and `desktop_ssh_policy_check_failed`, described under [Policy status on the remote host](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md#policy-status-on-the-remote-host).
65For static collector headers, extra resource attributes, and the log level of the desktop application's own event stream, see [`otlpHeaders`, `otlpResourceAttributes`, and `otlpDesktopLogLevel`](https://claude.com/docs/third-party/claude-desktop/configuration#otlpheaders) in the configuration reference. Events on the `claude-desktop` stream include `desktop_ssh_sandbox_check_failed`, described under [Sandbox status on the remote host](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md#sandbox-status-on-the-remote-host), and `desktop_ssh_policy_check_failed`, described under [Policy status on the remote host](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md#policy-status-on-the-remote-host).
6666
6767### Collector endpoint and headers
6868
from line 74
7474
7575The receiver must implement the OpenTelemetry protocol (OTLP) over HTTP in both its protobuf and JSON encodings, as an OpenTelemetry Collector does by default. If your logging or SIEM platform accepts only its own HTTP ingestion format, run an OpenTelemetry Collector that receives OTLP and forwards to that platform, and set `otlpEndpoint` to the collector's address. Each device opens its own connection to the collector, so the collector must present a TLS certificate the operating system trusts. See [TLS-intercepting proxies](https://claude.com/docs/third-party/claude-desktop/network-proxy.md#tls-intercepting-proxies) if a TLS-intercepting proxy sits in between.
7676
77[`otlpHeaders`](https://claude.com/docs/third-party/claude-desktop/configuration#otlpheaders) is a JSON object that maps each header name to its value, for example `{"Authorization":"Bearer <token>","X-Tenant":"agency"}`. As with the other object-typed keys described under [Value types](https://claude.com/docs/third-party/claude-desktop/configuration-format.md#value-types), write it as a JSON string.
77[`otlpHeaders`](https://claude.com/docs/third-party/claude-desktop/configuration#otlpheaders) is a JSON object that maps each header name to its value, for example `{"X-Scope-OrgID":"tenant-a","X-Tenant":"agency"}`. Write the object as a JSON string, as described under [Value types](https://claude.com/docs/third-party/claude-desktop/configuration-format.md#value-types).
7878
7979The app reads both keys at launch, so users must restart it after a change. If the collector refuses requests or cannot be reached, the app keeps working, shows no error, and drops the affected telemetry batches. Check the collector's own request logs to confirm data is arriving.
8080
81For a collector credential that cannot be a static header, [`otlpHeadersHelper`](https://claude.com/docs/third-party/claude-desktop/configuration#otlpheadershelper) names a script on the device that prints the headers, and [`otlpAuthMode`](https://claude.com/docs/third-party/claude-desktop/configuration#otlpauthmode) set to `inference-credential` sends the user's own inference bearer token, which suits only a collector you operate. The configuration reference describes both.
81To send a credential to your collector, use one of these keys:
82
83* **[`otlpHeadersHelper`](https://claude.com/docs/third-party/claude-desktop/configuration#otlpheadershelper)**: set it to the full path of a script on the device that prints the headers as a JSON object, for example `{"Authorization":"Bearer <token>"}`
84* **[`otlpAuthMode`](https://claude.com/docs/third-party/claude-desktop/configuration#otlpauthmode)**: set it to `inference-credential` to send the user's own inference bearer token, which suits only a collector you operate
85
86If you set a credential in `otlpHeaders` from an MDM profile, the local configuration file, or your own [bootstrap server](https://claude.com/docs/third-party/claude-desktop/bootstrap.md), the app sends it to the collector. The app treats the value of `otlpHeaders` as routing settings, not a credential, and doesn't encrypt that value on the device. The [Enterprise Admin Console](https://claude.com/docs/third-party/claude-desktop/admin-console.md#what-you-can-configure) refuses to save a credential in `otlpHeaders`.
8287
8388### User attribution
8489
No line in this hunk matches that.