Claude apps gateway configuration changedclaude-apps-gateway-config
Nearest release: v2.1.321, published an hour before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 9 Nov 2026 21:00 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 9 Nov 2026 21:07 UTC.
Upstream edited
Recorded here
Lines+38added
Lines−0removed
From line
24
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits72to this page, all time
### `login_notice` #### Pooled budget order
The whole hunk
from line 24, old and new numbered
/
from line 24
2424
2525**Optional sections:**
2626
27* [`login_notice`](#login_notice): a notice developers see when they sign in
2728* [`admin`](#admin): Admin API auth and retention for spend limits
2829* [`enforcement`](#enforcement): spend-limit fail-open or fail-closed behavior
2930* [`pricing`](#pricing): contracted rates and a multiplier for the spend meter and for the cost figures developers see
from line 844
843844
844845## Optional sections
845846
847### `login_notice`
848
849To show developers a notice when they sign in, set the top-level `login_notice` key to the notice text, up to 500 characters. This example says who the gateway is for and where to ask for access:
850
851```yaml theme={null}
852login_notice: This gateway is for Example Corp staff. For access questions, email [email protected].
853```
854
855Developers see the text under `Notice from <gateway hostname>` on the gateway's verification page in the browser and on the interactive sign-in screen in the terminal. Line breaks in the text become spaces. The notice appears before sign-in, so anyone who can reach the gateway can read it.
856
857Requires Claude Code v2.1.319 or later on the gateway server, and also on the developer's machine for the terminal screen. An earlier gateway refuses to start when it finds the key. Upgrade every replica before you add the key, and remove the key before you roll back.
858
846859### `admin`
847860
848861Optional. Enables `/v1/organizations/spend_limits`, which mirrors Anthropic's public Admin API, and per-developer spend enforcement on `/v1/messages`. See [Spend limits](https://code.claude.com/docs/en/claude-apps-gateway-spend-limits.md) for how caps are set and enforced; this section covers the `gateway.yaml` keys that turn the feature on and tune it.
from line 874
861874 # IdP groups granted full admin via the normal gateway JWT (no API key).
862875 admin_groups: [platform-finops]
863876 blocked_message: request an increase at https://go.example.com/claude-limits
877 # Try eng-platform's pooled budget first, then eng-all's, then any other group's.
878 pooled_conflict_rule: priority_list
879 pooled_priority_order: [eng-platform, eng-all]
864880```
865881
866882| Field | Required | Description |
from line 889
873889| `spend_retention_months` | No | Default `13`. `spend` counter rows older than this are swept. The default keeps a full year plus the current partial month for year-over-year reporting. |
874890| `identity_retention_days` | No | Default `90`. Last-seen TTL for `principal_emails` rows, which hold each developer's email, display name, and groups (PII). Deliberately shorter than spend retention so a deprovisioned identity ages out while its anonymous spend counters remain. |
875891| `group_limit_mode` | No | `min` (default) or `max`. When a developer is in several groups with caps, `min` enforces the most restrictive and `max` the least. Used by both enforcement and `/effective`. |
892| `pooled_conflict_rule` | No | `default_order` (default) or `priority_list`. The order the gateway tries a developer's pooled budgets in. See [Pooled budget order](#pooled-budget-order). Requires v2.1.319 or later. |
893| `pooled_priority_order` | With `priority_list` | Up to 50 group names, each listed once and spelled as your IdP sends it. The groups whose pooled budgets the gateway tries first. See [Pooled budget order](#pooled-budget-order). Requires v2.1.319 or later. |
876894
895#### Pooled budget order
896
897A pooled budget is one monthly limit that a whole group spends against. To set one, add `pooled_budget` to the [request that sets the group's monthly cap](https://code.claude.com/docs/en/claude-apps-gateway-spend-limits.md#set-a-cap), as in `"pooled_budget": {"amount": "500000"}` for \$5,000. The request also takes the group's `scope`, `"period": "monthly"`, and `amount`, which stays each member's own cap.
898
899For a developer in several such groups, each request counts against the first budget whose spend is below its limit, and is refused when every budget is used up. `pooled_conflict_rule` sets the order the gateway tries the budgets in:
900
901* **`default_order`**: the largest limit first, and equal limits in ascending group-name order
902* **`priority_list`**: the budgets of the groups in `pooled_priority_order`, in list order, then the other groups' budgets by group name
903
904If you list groups without `pooled_conflict_rule: priority_list`, the gateway ignores the list and logs a warning at boot.
905
906A gateway server earlier than v2.1.319 refuses to start when it finds `pooled_conflict_rule` or `pooled_priority_order`. Upgrade every replica before you add either key, and remove both keys before you roll back.
907
877908### `enforcement`
878909
879910The `enforcement` block controls how spend-limit checks behave when the store is unavailable.
from line 1702
16711702# environment variable (debug | info | warn | error; default info). debug
16721703# also logs the claim names in each id_token, for groups_claim diagnosis.
16731704# It does not affect audit events, which are always emitted.
1705# Set CLAUDE_GATEWAY_LOG_FORMAT=json to write operational log lines as JSON
1706# objects with severity, time, and message.
16741707
16751708listen:
16761709 host: 0.0.0.0
from line 1744
17111744 # connect_timeout_seconds: 5
17121745 # readiness_grace_seconds: 300 # keep passing the readiness check through a database failover
17131746
1747# Notice shown at sign-in. Anyone who can reach the gateway can read it.
1748# login_notice: This gateway is for Example Corp staff. For access questions, email [email protected].
1749
17141750# Enables /v1/organizations/spend_limits (mirrors the Anthropic Admin API)
17151751# and per-developer spend enforcement on /v1/messages. Omit to disable.
17161752# Caps themselves are set via the admin API, not here.
from line 1761
17251761# # spend_retention_months: 13
17261762# # identity_retention_days: 90
17271763# # group_limit_mode: min
1764# # pooled_conflict_rule: priority_list
1765# # pooled_priority_order: [eng-platform, eng-all]
17281766
17291767# enforcement:
17301768# fail_closed_on_error: false
No line in this hunk matches that.