Connect a service that isn't in the list changedclaude-tag/admins/connections/custom
Nearest release: v2.1.284, published 2 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 28 Sep 2026 20:03 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 28 Sep 2026 22:07 UTC.
Upstream edited
Recorded here
Lines+28added
Lines−28removed
From line
22
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits16to this page, all time
The whole hunk
from line 22, old and new numbered
/
from line 22
2222
2323### Fill out the Custom tool form
2424
25| Field | What to enter |
26| :--------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
27| **Name** | A label for this connection (for example "Internal billing API") |
28| **Credential type** | Pick the type that matches how the API authenticates; see [Credential types](#credential-types) |
29| **Allowed websites** | The API's host (for example `api.example.com`). A wildcard is allowed as the leftmost label. You can't enter `*` alone here; a credential is always limited to specific hosts (see [Allow all hosts](/docs/claude-tag/admins/add-connections#allow-all-hosts)). The credential is sent only to hosts you list here. |
30| **Path prefixes** (optional) | Restrict the credential to specific URL paths under the host. Shown only for the MCP Connector type, and only when the provider you pick doesn't fix its own hosts and paths. |
31| **Custom headers** | Any extra headers the API requires beyond the credential. Shown only for the Bearer credential type. |
25| Field | What to enter |
26| :- | :- |
27| **Name** | A label for this connection (for example "Internal billing API") |
28| **Credential type** | Pick the type that matches how the API authenticates; see [Credential types](#credential-types) |
29| **Allowed websites** | The API's host (for example `api.example.com`). A wildcard is allowed as the leftmost label. You can't enter `*` alone here; a credential is always limited to specific hosts (see [Allow all hosts](/docs/claude-tag/admins/add-connections#allow-all-hosts)). The credential is sent only to hosts you list here. |
30| **Path prefixes** (optional) | Restrict the credential to specific URL paths under the host. Shown only for the MCP Connector type, and only when the provider you pick doesn't fix its own hosts and paths. |
31| **Custom headers** | Any extra headers the API requires beyond the credential. Shown only for the Bearer credential type. |
3232
3333After saving, where the credential has an allow rule, you can narrow it by HTTP method and path from its **Edit connection** dialog; see [Restrict by path or method](/docs/claude-tag/admins/add-connections#restrict-by-path-or-method).
3434
3535### Credential types
3636
37| Type | Use for |
38| :---------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
39| **Bearer** | An API key or token sent as `Authorization: Bearer <token>`. Most SaaS REST APIs. |
40| **Basic** | HTTP Basic authentication (`Authorization: Basic <base64(user:password)>`) |
41| **Body parameter** | A token the API expects in the request body or query string instead of a header |
42| **AWS SigV4** | AWS service APIs on `amazonaws.com` endpoints that require Signature Version 4 signing |
43| **GCP access token (with Service Account Key)** | Google Cloud APIs; the proxy exchanges the SA key for an access token |
44| **GCP IAP (with Service Account Key)** | Google Cloud services behind Identity-Aware Proxy |
45| **OAuth 2.0 JWT bearer** | APIs that accept a JWT signed with your private key in exchange for an access token (DocuSign, for example) |
46| **OAuth 2.0 client credentials** | Machine-to-machine OAuth with a client ID and secret |
47| **MCP Connector** | OAuth sign-in to one of the providers in the picker or to a [remote MCP connector](/docs/connectors/custom/add-unlisted) your organization has added on claude.ai. Sign in once as an admin; the agent acts as that account. Other OAuth APIs can't be connected this way. |
37| Type | Use for |
38| :- | :- |
39| **Bearer** | An API key or token sent as `Authorization: Bearer <token>`. Most SaaS REST APIs. |
40| **Basic** | HTTP Basic authentication (`Authorization: Basic <base64(user:password)>`) |
41| **Body parameter** | A token the API expects in the request body or query string instead of a header |
42| **AWS SigV4** | AWS service APIs on `amazonaws.com` endpoints that require Signature Version 4 signing |
43| **GCP access token (with Service Account Key)** | Google Cloud APIs; the proxy exchanges the SA key for an access token |
44| **GCP IAP (with Service Account Key)** | Google Cloud services behind Identity-Aware Proxy |
45| **OAuth 2.0 JWT bearer** | APIs that accept a JWT signed with your private key in exchange for an access token (DocuSign, for example) |
46| **OAuth 2.0 client credentials** | Machine-to-machine OAuth with a client ID and secret |
47| **MCP Connector** | OAuth sign-in to one of the providers in the picker or to a [remote MCP connector](/docs/connectors/custom/add-unlisted) your organization has added on claude.ai. Sign in once as an admin; the agent acts as that account. Other OAuth APIs can't be connected this way. |
4848
4949<Note>The **MCP Connector** type signs in to a connector from your organization's connector library. If you register a new connector from this form with **Add custom connector…**, that connector is added to the library on the **Connectors** page at [`claude.ai/admin-settings/connectors`](https://claude.ai/admin-settings/connectors), not only to the bundle. Removing the connection from the bundle later leaves the library entry in place.</Note>
5050
from line 65
6565
6666Requests to other hostnames fail before reaching AWS. Agent Proxy can't sign a request to a hostname with no region for any other service, such as `ec2.amazonaws.com`, or to a hostname with the region before the service name, such as an OpenSearch domain endpoint (`my-domain.us-east-1.es.amazonaws.com`). It also can't sign requests to an API Gateway custom domain or to a non-AWS API that uses Signature Version 4.
6767
68| Field | Value |
69| :---------------- | :---------------------------------------------------------------------------------------------------------- |
70| Access key ID | The IAM user or role access key, for example `AKIAIOSFODNN7EXAMPLE` |
71| Secret access key | The matching secret access key |
72| Session token | Optional. Only needed for temporary credentials from AWS STS. |
73| Allowed websites | The AWS service endpoint host, for example `s3.us-east-1.amazonaws.com` or `lambda.us-east-1.amazonaws.com` |
68| Field | Value |
69| :- | :- |
70| Access key ID | The IAM user or role access key, for example `AKIAIOSFODNN7EXAMPLE` |
71| Secret access key | The matching secret access key |
72| Session token | Optional. Only needed for temporary credentials from AWS STS. |
73| Allowed websites | The AWS service endpoint host, for example `s3.us-east-1.amazonaws.com` or `lambda.us-east-1.amazonaws.com` |
7474
7575Use long-lived credentials from a dedicated IAM user where you can. Temporary STS credentials work but expire on their own schedule, and the connection stops working when they do; you re-enter all three values to rotate.
7676
from line 80
8080
8181A `SignatureDoesNotMatch` response from AWS means the request AWS received doesn't match the one Agent Proxy signed.
8282
83| Check | What to do |
84| :---------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
85| The access key ID and secret access key belong to the same IAM identity | Re-enter the access key ID, secret access key, and session token together. The form is write-only, so a partial update can leave them mismatched. |
86| No proxy or gateway of your own sits between Anthropic and AWS | A second proxy that adds, strips, or reorders headers, or that re-signs the request, invalidates the signature Agent Proxy attached. Point **Allowed websites** at the AWS endpoint directly. |
83| Check | What to do |
84| :- | :- |
85| The access key ID and secret access key belong to the same IAM identity | Re-enter the access key ID, secret access key, and session token together. The form is write-only, so a partial update can leave them mismatched. |
86| No proxy or gateway of your own sits between Anthropic and AWS | A second proxy that adds, strips, or reorders headers, or that re-signs the request, invalidates the signature Agent Proxy attached. Point **Allowed websites** at the AWS endpoint directly. |
8787
8888A dropped or expired session token is a different failure: AWS rejects it with a token error such as `InvalidClientTokenId`, not `SignatureDoesNotMatch`. Rotate all three fields.
8989
No line in this hunk matches that.