196 pages for scopes.

Configure the sandboxed Bash tool Claude Code CLI · in the page sandboxing …ds`. When you define the same filesystem array in multiple [settings scopes](/docs/en/settings.md#settings-precedence), Claude Code merges them, combining the paths rather than replacing one scope's… Security Claude Code CLI · in the page security …mcp.json`, which you can check into source control. Servers at [other scopes](/docs/en/mcp.md#mcp-installation-scopes) and [claude.ai connectors](/docs/en/mcp.md#how-connectors-reach-claude-code) are… Verify session identity in self-hosted environments Claude Code CLI · in the page self-hosted-environments-identity …claim in any of the environment's session tokens. This check is what scopes the token to your environment and rejects tokens issued to other organizations. **5. Verify the role** Reject the token i… Test self-hosted environments end to end Claude Code CLI · in the page self-hosted-environments-testing …runner, set [`CLAUDE_CODE_OAUTH_REFRESH_TOKEN` and `CLAUDE_CODE_OAUTH_SCOPES`](/docs/en/env-vars#variables) so `claude auth login` exchanges the token without a browser; the same 30-day cap applies to… Claude Code settings Claude Code CLI · in the page settings …` to `/config`, for example `/config verbose=true`. ## Configuration scopes Claude Code uses a scope system to determine where configurations apply and who they're shared with. Understanding scopes… All settings Claude Code CLI · in the page settings-reference …de tells you to run `/model fable` first. * **Scope**: [`Any file`](#scopes) * **Type**: string, one of the aliases `"fable"`, `"opus"`, or `"sonnet"`, which resolve to Claude Code's current default… Extend Claude with skills Claude Code CLI · in the page skills …ent-skills). ## Share skills Skills can be distributed at different scopes depending on your audience: * **Project skills**: Commit `.claude/skills/` to version control * **Plugins**: Create a `ski… Create custom subagents Claude Code CLI · in the page sub-agents …s/` directories are also scanned recursively. Unlike project and user scopes, a subfolder inside a plugin's `agents/` directory becomes part of the [scoped identifier](#invoke-subagents-explicitly): a… Use Claude Code in VS Code Claude Code CLI · in the page vs-code …the local, user, or project [scope](/docs/en/mcp.md#mcp-installation-scopes) * Enable or disable servers * Reconnect to a server * Manage OAuth authentication Adding and removing servers in the dial… Week 20 · May 11–15, 2026 Claude Code CLI · in the page whats-new/2026-w20 …`) to configure background sessions, and `claude agents --cwd <path>` scopes the session list to a directoryNew hook `args: string[]` exec form spawns the command directly without a shell, so path pla… Give Claude access to your tools Claude Documentation · in the page claude-tag/admins/add-connections …restrict the delegation to that single subject and the minimum OAuth scopes; DWD can otherwise impersonate any user in your domain. | | SaaS with native service accounts (Datadog, Snowflake, Sentry)… Configure per-channel access Claude Documentation · in the page claude-tag/admins/attach-to-scope …eneral availability. A bundle applies at one of three levels, called scopes, and each has its own page on the **Channels** tab under **Claude's access** at [`claude.ai/admin-settings/claude-tag`](htt… Connect Jira and Confluence Claude Documentation · in the page claude-tag/admins/connections/atlassian …efore the old one lapses. > [!NOTE] > > Create the API token without scopes. Atlassian accepts tokens with scopes, including service account tokens, only at its `api.atlassian.com` gateway, not at yo… Connect Datadog Claude Documentation · in the page claude-tag/admins/connections/datadog …under the same service account. The Application key carries the read scopes, so restrict it to read-only roles. The form doesn't require the Application key, but reading metrics, monitors, and dashbo… Connect Google Drive, Calendar, and Gmail Claude Documentation · in the page claude-tag/admins/connections/google …ect form lists the Google hosts the connector can reach; there are no scopes to choose. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as s… Connect HubSpot Claude Documentation · in the page claude-tag/admins/connections/hubspot …e the credential in HubSpot Create a private app and select the read scopes you need (typically `crm.objects.contacts.read`, `crm.objects.companies.read`, `crm.objects.deals.read`). The private app a… Connect Salesforce Claude Documentation · in the page claude-tag/admins/connections/salesforce …nt, `https://yourcompany.my.salesforce.com/services/oauth2/token` | | Scopes (optional) | On the **Advanced** tab. Leave empty unless your app requires specific scopes | | Allowed websites | Your org'… Customize Claude Tag Claude Documentation · in the page claude-tag/admins/customize …cess.md#delegate-claude-tag-administration) for workspace and channel scopes; channel members for the channel scope, from the [Configure page](/docs/claude-tag/users/good-habits.md#configure-claude-fo… Connect an authorization server Claude Documentation · in the page claude-tag/admins/federated-access/authorization-server …e:jwt-bearer&assertion=<identity token>[&resource=<resource>][&scope=<scopes>] ``` The `resource` ([RFC 8707](https://www.rfc-editor.org/rfc/rfc8707)) and `scope` fields are present only if you set t… Connect an AWS role Claude Documentation · in the page claude-tag/admins/federated-access/aws …e connection [applies](/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit). ## Related resources * [Give Claude access](/docs/claude-tag/admins/add-connections.md): the bundle and connect… Connect a gateway Claude Documentation · in the page claude-tag/admins/federated-access/connect-a-gateway …e connection [applies](/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit). ## Related resources * [Give Claude access](/docs/claude-tag/admins/add-connections.md): the bundle and connect… Connect a Google Cloud identity Claude Documentation · in the page claude-tag/admins/federated-access/gcp …e connection [applies](/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit). ## Related resources * [Give Claude access](/docs/claude-tag/admins/add-connections.md): the bundle and connect… Troubleshoot federated agent access Claude Documentation · in the page claude-tag/admins/federated-access/troubleshooting …e Google Drive, Calendar, and Gmail APIs, answer 403 for insufficient scopes whatever IAM allows. If the 403 comes from a Google Cloud API, such as Cloud Storage, the OAuth scope isn't the cause, so… What the Claude Slack app can access Claude Documentation · in the page claude-tag/admins/for-slack-admins …can access > What the Claude app reads and posts in Slack, the OAuth scopes it requests, and what installing it does not grant. Written for the Slack admin approving the install. > [!NOTE] > > Claud… Restrict where Claude Tag operates Claude Documentation · in the page claude-tag/admins/restrict-access …workspace's sessions and transcripts, memory, routines and artifacts, scopes, and members' account links, and the app stays installed so a workspace admin can pair again; see [what each action deletes… Set a spend limit Claude Documentation · in the page claude-tag/admins/set-spend-limit …ch maps to one team or department, and give those channels [their own scopes](/docs/claude-tag/admins/attach-to-scope.md). The per-channel breakdown then reads as your per-team report, and per-channel… Set up Claude Tag Claude Documentation · in the page claude-tag/admins/setup-overview …re per-channel access](/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit): how Slack, workspaces, and channels inherit bundles * [Claude Tag settings map](/docs/claude-tag/concepts/setting… Troubleshoot Claude Tag setup Claude Documentation · in the page claude-tag/admins/troubleshooting …age's **Claude's access** table includes access [inherited from wider scopes](/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit), and its **Inheritance** column names where each bundle, an… Manage workspaces and versions Claude Documentation · in the page claude-tag/admins/workspaces …set up in its channels, and the artifacts published from them > * Its scopes, with their instructions and bundle bindings > * The links between members' Slack and Claude accounts > > Deletion starts a… Data lifecycle and deletion Claude Documentation · in the page claude-tag/concepts/data-lifecycle …ls or in direct messages, with their instructions and run history | | Scopes and their settings | Each workspace and channel [scope](/docs/claude-tag/concepts/glossary.md#scope), with its custom instr… Glossary Claude Documentation · in the page claude-tag/concepts/glossary …-wide root), one Slack workspace, or one channel (public or private). Scopes inherit downward, so a channel gets its workspace's settings plus any of its own. In Claude Tag admin settings, all of Slac… Security and data handling Claude Documentation · in the page claude-tag/concepts/security-and-data …on the **Connectors** tab is on here as soon as you save it. See [how scopes inherit](/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit). * **A channel rule.** A bundle an Owner applies to… Claude Tag for marketing teams Claude Documentation · in the page claude-tag/users/use-cases/marketing-team …(/docs/claude-tag/admins/connections/hubspot.md) is created with read scopes, so prompts in this channel pull records and don't change them. For account questions, pre-call briefs, and a pipeline dige… Review documents against a checklist Claude Documentation · in the page claude-tag/users/use-cases/review-documents …s status and what's missing. ``` Naming both the list and the folder scopes the search to the documents that matter. ### Compare with the last review A revised draft is in, and you need to know whe… Authentication for connectors Claude Documentation · in the page connectors/building/authentication …quired, and the page each one should link to. ### PKCE and requested scopes Claude includes a [PKCE](https://datatracker.ietf.org/doc/html/rfc7636) `code_challenge` with `code_challenge_method=S256`… Lazy authentication for MCP servers Claude Documentation · in the page connectors/building/lazy-authentication …nts) document * Optionally add a `scope` parameter naming the minimum scopes your protected tools need * Return from the handler before calling the MCP SDK, and keep the check before `transport.handle… Add a connector that isn't in the directory Claude Documentation · in the page connectors/custom/add-unlisted …rs from trusted organizations * Carefully review requested permission scopes during authentication * Be aware of prompt injection risks. Claude has built-in protections * Monitor for unexpected change… Authenticate to MCP servers behind a tunnel Claude Documentation · in the page connectors/mcp-tunnels/oauth …ps://auth.abc123.tunnel.anthropic.com/oauth/register` | | **Requested scopes** | The scopes Claude requests at sign-in, separated by spaces. | `openid wiki:read wiki:write` | The paths after the host… Microsoft 365 connector Claude Documentation · in the page connectors/microsoft/365 …rict which users can use the connector, or revoke specific permission scopes. For the detailed administrator walkthrough, see [Set up the Microsoft 365 connector](https://support.claude.com/en/articl… Connector verification Claude Documentation · in the page connectors/verification …trol how it handles your data * Carefully review requested permission scopes during authentication * Stay aware of prompt injection risks, even though Claude has built-in protections * Monitor for une… Changelog Claude Documentation · in the page cowork/changelog …ID asking users to sign in again after a restart when `bootstrapOidc.scopes` uses `/.default`. * Fixed pop-out windows doing nothing: "Open in new window" and ⌘-click (or Ctrl+click on Windows and Li… Connectors Claude Documentation · in the page government/connectors/overview …scope for an app registered in your tenant), because Microsoft Graph scopes such as `Mail.Read` would give the connector's server access to members' Microsoft 365 data. Neither OAuth option stores a… Deploy with Enterprise Admin Console Claude Documentation · in the page third-party/claude-desktop/admin-console …ce it. Only that organization's **Create key** dialog lists these two scopes. A key that reads and writes needs both scopes. Copy the key when it's shown, because you can't view it again. Pass the ke… Deploy Claude Desktop on 3P with Amazon Bedrock Claude Documentation · in the page third-party/claude-desktop/bedrock …-xxxxxxxxxx.awsapps.com/start sso_region = us-east-1 sso_registration_scopes = sso:account:access ``` When the cached IAM Identity Center token is missing or expired, the app prompts the user to sign… Deploy with a bootstrap server Claude Documentation · in the page third-party/claude-desktop/bootstrap …rosoftonline.com/YOUR_TENANT_ID/v2.0` | | Bootstrap OIDC parameters → Scopes | `openid offline_access YOUR_CLIENT_ID/.default` | | Bootstrap OIDC parameters → Redirect port | leave empty for Entra; se… Configuration reference Claude Documentation · in the page third-party/claude-desktop/configuration …client secret | Connection | Admin Console | | [`inferenceVertexOAuthScopes`](#inferencevertexoauthscopes) | Vertex OAuth scopes | Connection | Admin Console | | [`inferenceVertexOAuthLoginHint`](#in… Configuration changelog Claude Documentation · in the page third-party/claude-desktop/configuration-changelog …ing>", "bearerTokenType": "<id_token|access_token>", "scopes": "<string>", "appendOfflineAccess": "<boolean>", "resource": "<string>", "redirectPort": "<integer… Connect to GitHub Claude Documentation · in the page third-party/claude-desktop/connectors-github …the endpoint URL, the supported authentication methods, and the token scopes your tools need against [GitHub's github-mcp-server documentation](https://github.com/github/github-mcp-server), which is t… Connect to Microsoft 365 Claude Documentation · in the page third-party/claude-desktop/connectors-m365 …, working with files, and sending Teams messages) depend on the write scopes approved in Microsoft Entra: * **Remote connector**: an administrator approves the scopes on the Anthropic connector app.… Connect to Salesforce Claude Documentation · in the page third-party/claude-desktop/connectors-salesforce …gs: * The callback URL `http://127.0.0.1:53280/callback` * The OAuth scopes `mcp_api` and `refresh_token` * Proof Key for Code Exchange (PKCE) required * Access tokens issued as JSON Web Tokens (JWTs…