118 pages for issuer.
Titles and paths first, then pages whose text carries it. Each row opens that page as this site last read it.
gcp
Claude Developer Platform · in the page
manage-claude/wif-providers/gcp
…e-signed identity token for its attached service account. The token's issuer is `https://accounts.google.com`, and Anthropic can validate it directly through standard OIDC discovery, with no extra Goo…
github-actions
Claude Developer Platform · in the page
manage-claude/wif-providers/github-actions
…workflow run can request a signed identity token from GitHub's hosted issuer at `https://token.actions.githubusercontent.com`. With Workload Identity Federation, your workflow exchanges that token for…
kubernetes
Claude Developer Platform · in the page
manage-claude/wif-providers/kubernetes
…t-token-volume-projection). The cluster's API server acts as the OIDC issuer, and each token's `sub` claim follows the form `system:serviceaccount:<namespace>:<service-account>`. You can find your clu…
okta
Claude Developer Platform · in the page
manage-claude/wif-providers/okta
…opic for a short-lived access token. The Okta authorization server's issuer URL takes the form `https://<your-domain>.okta.com/oauth2/<auth-server-id>`. If you use the built-in default server, the pa…
Replace NODE_UID with the node's UID:
Claude Developer Platform · in the page
manage-claude/wif-providers/spiffe
…Claude API using JWT-SVIDs from SPIRE or any other SPIFFE-conformant issuer. --- [SPIFFE](https://spiffe.io/) is the CNCF standard for issuing identity to workloads. [SPIRE](https://spiffe.io/docs/l…
wif-reference
Claude Developer Platform · in the page
manage-claude/wif-reference
…`workspace:developer` or `workspace:inference`, and cannot update an issuer that backs a rule with any other scope; see [Permissions and constraints](https://platform.claude.com/docs/en/manage-claude…
workload-identity-federation
Claude Developer Platform · in the page
manage-claude/workload-identity-federation
…ready operate: AWS IAM, Google Cloud, or any standards-compliant OIDC issuer such as GitHub Actions, Kubernetes, SPIFFE, Microsoft Entra ID, or Okta. Your workload presents a signed JWT from your ide…
overview
Claude Developer Platform · in the page
release-notes/overview
…API keys, rate limits, service accounts, workload identity federation issuers and rules, and customer-managed encryption keys. Usage and cost reports and the Claude Enterprise user-management and anal…
Claude Code on Amazon Bedrock
Claude Code CLI · in the page
amazon-bedrock
…the OS store, the affected requests failed with `unable to get local issuer certificate`, or the wizard showed models as `unreachable`, while inference requests succeeded. Update to v2.1.261 or later…
Claude apps gateway for Amazon Bedrock, Claude Platform on AWS, Google Cloud, and Microsoft Foundry
Claude Code CLI · in the page
claude-apps-gateway
…t. public_url: https://claude-gateway.internal.example.com oidc: issuer: https://login.example.com # must serve /.well-known/openid-configuration client_id: 0oa1example2 client_secret:…
Claude apps gateway configuration
Claude Code CLI · in the page
claude-apps-gateway-config
…ermination * [`oidc`](#oidc): your identity provider (IdP), including issuer, client, claim mapping, and who may sign in * [`session`](#session): the bearer tokens the gateway mints, with secret and l…
Claude apps gateway deployment and operations
Claude Code CLI · in the page
claude-apps-gateway-deploy
…uration`, over HTTPS in production; the gateway accepts an [`http://` issuer](/docs/en/claude-apps-gateway-config#oidc), and a loopback issuer additionally requires `CLAUDE_GATEWAY_ALLOW_LOOPBACK=1` *…
Deploy Claude apps gateway on AWS
Claude Code CLI · in the page
claude-apps-gateway-on-aws
…nal.example.com trusted_proxies: [<your-alb-subnet-cidrs>] oidc: issuer: https://example.okta.com client_id: 0oa1example2 client_secret: ${OIDC_CLIENT_SECRET} # EKS: ${file:/secrets…
Deploy Claude apps gateway on Google Cloud
Claude Code CLI · in the page
claude-apps-gateway-on-gcp
…ted_proxies: [169.254.0.0/16, <your-proxy-only-subnet-cidr>] oidc: issuer: https://accounts.google.com client_id: <your-oauth-client-id> client_secret: ${OIDC_CLIENT_SECRET} # GKE: ${…
Error reference
Claude Code CLI · in the page
errors
…[Authentication](#mcp-server-url-is-missing-or-not-a-valid-url) | | `Issuer mismatch in authorization response (RFC 9207)` | [Authentication](#issuer-mismatch-in-authorization-response) | | `Refusing…
Use Claude Code GitHub Actions with cloud providers
Claude Code CLI · in the page
github-actions-cloud-providers
…` * Create a Workload Identity Pool with a GitHub OIDC provider whose issuer is `https://token.actions.githubusercontent.com`, and add an attribute condition that limits the pool to your repository *…
Connect Claude Code to tools via MCP
Claude Code CLI · in the page
mcp
…-remote-mcp-servers) whose authorization response names an unexpected issuer. * Sends [MCP OAuth](#authenticate-with-remote-mcp-servers) credentials only to a token endpoint served over HTTPS or at `l…
Verify session identity in self-hosted environments
Claude Code CLI · in the page
self-hosted-environments-identity
…signed with a key your cached set doesn't have yet. **3. Verify the issuer** Reject the token if `iss` is not exactly `ccr`. **4. Verify the audience against your environment** The `aud` claim is…
Troubleshoot installation and login
Claude Code CLI · in the page
troubleshoot-install
…ps://www.anthropic.com/supported-countries). | | `unable to get local issuer certificate` | [Configure corporate CA certificates](#tls-or-ssl-connection-errors) | | `OAuth error` or `403 Forbidden` |…
Voice dictation
Claude Code CLI · in the page
voice-dictation
…error:` followed by a certificate error such as `unable to get local issuer certificate`**: see [Dictation or the Web tab fails behind a TLS-inspecting proxy](/docs/en/vs-code.md#dictation-or-the-web…
Use Claude Code in VS Code
Claude Code CLI · in the page
vs-code
…error:` followed by a certificate error such as `unable to get local issuer certificate`, or `Remote server is not connected` on the Web tab | [Dictation or the Web tab fails behind a TLS-inspecting…
Use Claude Science on a corporate network
Claude Documentation · in the page
claude-science/corporate-networks
…porate network errors ### Token exchange failed: unable to get local issuer certificate Sign-in completes in the browser, then fails with this error when Claude Science's own connection to Anthropic…
Connect an authorization server
Claude Documentation · in the page
claude-tag/admins/federated-access/authorization-server
…-a-gateway.md), and an authorization server's audience address (its **Issuer URL** value, or its token endpoint when that field is empty) counts as one. ## Copy the values from the console In **Auth…
Connect an AWS role
Claude Documentation · in the page
claude-tag/admins/federated-access/aws
…ole In **Cloud roles**, click **Connect an AWS role** and copy the **Issuer**, **Audience**, and **Subject prefix** rows from the **Set the role's trust policy to accept these values** card. The card…
Connect a gateway
Claude Documentation · in the page
claude-tag/admins/federated-access/connect-a-gateway
…gateway In **Gateways**, click **Connect a gateway** and copy the **Issuer**, **JWKS URL**, **Subject prefix**, and **Control subject** rows from the **Set your gateway to accept these values** card…
Connect a Google Cloud identity
Claude Documentation · in the page
claude-tag/admins/federated-access/gcp
…y pools aren't supported. * If an organization policy restricts which issuers your workload identity pools may trust, allow `https://identity.anthropic.com/agents` first. * You know which Google API h…
Limits for federated agent access
Claude Documentation · in the page
claude-tag/admins/federated-access/limits
…ng slash is dropped. | | Token audience | Your authorization server's issuer identifier as you entered it (an HTTPS URL on the same host as the token endpoint, with the same address rules), or the tok…
Federated agent access
Claude Documentation · in the page
claude-tag/admins/federated-access/overview
…or gateway administrator configures that system to trust Anthropic's issuer and to check that each token's subject belongs to your organization, and the system then decides what the agent may do. To…
Identity token reference
Claude Documentation · in the page
claude-tag/admins/federated-access/token-reference
# Identity token reference > The claims, issuer, signing keys, lifetime, and subject format of the identity token Claude Tag presents to a gateway, cloud provider, or authorization server. > [!NOTE]…
Troubleshoot federated agent access
Claude Documentation · in the page
claude-tag/admins/federated-access/troubleshooting
…gister 5 addresses. An authorization server's audience address, its **Issuer URL** value or its token endpoint, is also registered as a gateway, so it counts toward the same 5 and appears in the **Gat…
Authentication for connectors
Claude Documentation · in the page
connectors/building/authentication
…ters it in Claude, including any path component * **List your primary issuer first**: the document's `authorization_servers` field must list your authorization server's issuer URL. If you list more th…
Enterprise Managed Auth for connectors
Claude Documentation · in the page
connectors/building/enterprise-managed-auth
…nd the signed JWT assertion. 2, your authorization server fetches the issuer's JWKS and verifies the signature. 3, it validates iss, aud, exp, sub, and client\_id. 4, it returns an access\_token to Cl…
Lazy authentication for MCP servers
Claude Documentation · in the page
connectors/building/lazy-authentication
…ce` to your MCP endpoint URL and `authorization_servers` to your real issuer In the example server, one function builds the protected resource metadata document and two routes serve it. The `resource…
Troubleshoot your connector
Claude Documentation · in the page
connectors/building/troubleshooting
…he two authorization-server curls against your authorization server's issuer host. ## Authorization with the MCP server failed This error usually appears after the OAuth flow has started. These are…
Authenticate to MCP servers behind a tunnel
Claude Documentation · in the page
connectors/mcp-tunnels/oauth
…account team. | Field | What to enter | Example | | - | - | - | | **Issuer** | The issuer identifier your authorization server puts in its metadata and tokens. This can be an internal URL, because C…
Changelog
Claude Documentation · in the page
cowork/changelog
…failing through explicit OAuth endpoints for identity providers whose issuer has a path. * Fixed model pickers showing no Effort control for newer models when `modelCatalogEnabled` is `false`; picker…
Claude for Government changelog
Claude Documentation · in the page
government/changelog
…s unusually fast is briefly told to try again. * Added a check of the Issuer against what your identity provider publishes when you save OIDC single sign-on. * Added a Test sign-in button to the Singl…
Identity and access
Claude Documentation · in the page
government/tenant-admin/identity-and-access
…shown again after you save. * **Authorization URL**, **Token URL**, **Issuer**, and **JWKS URL** are your identity provider's OIDC endpoints. Most providers show these on the application's overview or…
Tenant setup wizard
Claude Documentation · in the page
government/tenant-admin/setup-wizard
…these are the Client ID, Client secret, Authorization URL, Token URL, Issuer, and JWKS URL. For SAML this is a single IdP metadata XML document: paste the federation metadata from your provider, and t…
Deploy with Enterprise Admin Console
Claude Documentation · in the page
third-party/claude-desktop/admin-console
…y provider | **Gateway SSO IdP (OIDC)** with your identity provider's issuer URL and the client ID of the application you registered for Claude Desktop | The app shows a **Sign in to your organization…
Deploy Claude Desktop on 3P with Amazon Bedrock
Claude Documentation · in the page
third-party/claude-desktop/bedrock
…> <string>external-idp</string> <key>inferenceIdpOidc</key> <string>{"issuer":"https://YOUR_ORG.okta.com","clientId":"YOUR_CLIENT_ID","redirectPort":53180}</string> <key>inferenceModels</key> <string>…
Deploy with a bootstrap server
Claude Documentation · in the page
third-party/claude-desktop/bootstrap
…load; try { ({ payload } = await jwtVerify(token, JWKS, { issuer: `https://login.microsoftonline.com/${TENANT}/v2.0`, audience: CLIENT_ID, algorithms: ["RS256"], })); } c…
Configuration reference
Claude Documentation · in the page
third-party/claude-desktop/configuration
….0 | — | External IdP for gateway sign-in. The user’s token from this issuer is sent to the gateway as the Bearer credential. Deprecated: `inferenceGatewayOidc`; use inferenceIdpOidc with inferenceCre…
Configuration changelog
Claude Documentation · in the page
third-party/claude-desktop/configuration-changelog
…er|broker>", "oidc": { "clientId": "<string>", "issuer": "<string>", "authorizationUrl": "<string>", "tokenUrl": "<string>", "bearerTokenType": "<id_token…
Sign in through the OS identity broker
Claude Documentation · in the page
third-party/claude-desktop/entra-broker
…vailable only when your identity provider is Microsoft Entra ID: the `issuer` in `inferenceGatewayOidc`, `inferenceIdpOidc`, or `inferenceVertexWorkforceOidc` must have the form `https://login.microso…
MCP, plugins, skills, and hooks
Claude Documentation · in the page
third-party/claude-desktop/extensions
…uthorization-server` or `/.well-known/openid-configuration`, and the `issuer` in the metadata must match the authorization server URL, or sign-in stops. 3. Uses the client from `oauth.clientId`, or re…
Deploy Claude Desktop on 3P with an LLM gateway
Claude Documentation · in the page
third-party/claude-desktop/gateway
…dP (OIDC) → Client ID | `YOUR_CLIENT_ID` | | Gateway SSO IdP (OIDC) → Issuer URL | `https://login.microsoftonline.com/YOUR_TENANT_ID/v2.0` | | Gateway SSO IdP (OIDC) → Scopes | *leave empty for the de…
Set up sign-in for managed MCP servers
Claude Documentation · in the page
third-party/claude-desktop/mcp-sign-in
…et. Claude Desktop sends the secret only to the token endpoint of the issuer you name there, so a misconfigured or compromised MCP server can't redirect the token exchange, and the secret, to another…
Deploy Claude Desktop on 3P with Google Cloud's Agent Platform
Claude Documentation · in the page
third-party/claude-desktop/vertex
…owser by setting `inferenceVertexWorkforceAuthFlow` to `broker`. The `issuer` in `inferenceVertexWorkforceOidc` must then be `https://login.microsoftonline.com/TENANT_ID/v2.0`, and no loopback redirec…
Authorization Charter
Model Context Protocol · in the page
community/interest-groups/auth
…IG](/community/interest-groups/security)**: token-audience confusion, issuer validation, and account-linking risks sit at the boundary between the two groups * **[Transports WG](/community/working-gro…