{"name":"CLAUDE_GATEWAY_ALLOW_LOOPBACK","slug":"claude-gateway-allow-loopback","family":"env","title":"Environment variables","noun":"environment variable","description":"The gateway can authenticate callers with Anthropic-issued JWTs verified against a remote key endpoint.","description_source":"entry","described_by":{"version":"2.1.228","anchor":"self-hosted-gateway-can-admit-callers-with-anthropic-issued-"},"presence":{"first_seen":"2.1.160","removed_in":null,"in_current_build":true,"newest_mined":"2.1.308","builds":129,"mined_builds":149,"first_cited":{"version":"2.1.232","released_at":"2026-08-13 21:30:53","spans":6}},"aliases":[],"entries":[{"version":"2.1.285","anchor":"gatewayccr-requests-choose-host-ccr-gateway","heading":"Some requests now name a gateway or API host","line":"One kind of request now says whether it goes to `ccr-gateway` or `api`, depending on the kind of session","released_at":"2026-09-29 17:32:09","reason":"found in this entry's text, named in this entry"},{"version":"2.1.281","anchor":"claude-gateway-allow-loopback-helpers-restructured-in-gatewa","heading":"CLAUDE_GATEWAY_ALLOW_LOOPBACK helpers restructured in gateway module","line":"The code reading CLAUDE_GATEWAY_ALLOW_LOOPBACK was reorganised; the variable still lets the gateway reach loopback addresses","released_at":"2026-09-23 17:01:17","reason":"found in this entry's text, named in this entry"},{"version":"2.1.277","anchor":"gateway-egress-boundary-mode-outbound-traffic-can-defer-add","heading":"Gateway egress-boundary mode: outbound traffic can defer address checks to a forward proxy","line":"A new env var lets a gateway proxy handle outbound address safety checks itself instead of Claude Code","released_at":"2026-09-18 16:22:26","reason":"found in this entry's text"},{"version":"2.1.277","anchor":"gateway-self-host-config-per-upstream-custom-headers-and-a","heading":"Gateway self-host config: per-upstream custom headers, and a new loopback guard on telemetry forwarding","line":"Gateway config adds per-upstream custom headers and blocks loopback telemetry URLs unless explicitly allowed","released_at":"2026-09-18 16:22:26","reason":"found in this entry's text"},{"version":"2.1.265","anchor":"crigateway-loopback-config-validator-gains-an-escape-hatch","heading":"CRI\/gateway loopback config validator gains an escape-hatch env var","line":"Gateway loopback check now also covers cri.issuer and cri.policy.webhook.url, not just cri.jwks_url","released_at":"2026-09-08 19:05:16","reason":"found in this entry's text, named in this entry"},{"version":"2.1.243","anchor":"gateway-loopback-escape-hatch-is-still-present","heading":"Gateway loopback escape hatch is still present","line":"Pointing the gateway's key-set URL at a loopback address still needs that environment variable set.","released_at":"2026-08-24 23:10:45","reason":"named in this entry, found in this entry's text"},{"version":"2.1.238","anchor":"loopback-jwks-overrides-now-require-an-explicit-test-escape-","heading":"Loopback JWKS overrides now require an explicit test escape hatch","line":"Pointing the gateway key-set URL at loopback is now blocked unless you set CLAUDE_GATEWAY_ALLOW_LOOPBACK, which is for tests only.","released_at":"2026-08-20 18:01:54","reason":"named in this entry, found in this entry's text"},{"version":"2.1.232","anchor":"environment-variables-read-through-one-typed-table-instead-o","heading":"Environment variables read through one typed table instead of scattered process.env lookups","line":"Environment variables are now read through one typed table, with the same names and behaviour.","released_at":"2026-08-13 21:30:53","reason":"found in this entry's text"},{"version":"2.1.228","anchor":"self-hosted-gateway-can-admit-callers-with-anthropic-issued-","heading":"Self-hosted gateway can admit callers with Anthropic-issued JWTs","line":"The gateway can authenticate callers with Anthropic-issued JWTs verified against a remote key endpoint.","released_at":"2026-08-11 17:45:45","reason":"found in this entry's text"},{"version":"2.1.228","anchor":"gateway-customer-routed-inference-config-disabled-by-default","heading":"Gateway customer-routed inference config, disabled by default","line":"The self-hosted gateway accepts a strict customer-routed inference config block, off unless you enable it.","released_at":"2026-08-11 17:45:45","reason":"named in this entry, found in this entry's text"}],"entries_total":10,"docs":[{"source":"claude-code","path":"claude-apps-gateway-config","title":"Claude apps gateway configuration","documented":false},{"source":"claude-code","path":"claude-apps-gateway-deploy","title":"Claude apps gateway deployment and operations","documented":false},{"source":"claude-code","path":"claude-apps-gateway-on-aws","title":"Deploy Claude apps gateway on AWS","documented":false}],"docs_total":3,"gates":[],"related":[{"name":"CLAUDE_GATEWAY_DRAIN_TIMEOUT_MS","slug":"claude-gateway-drain-timeout-ms","description":"claude gateway now shuts down gracefully on SIGTERM\/SIGINT instead of exiting abruptly"},{"name":"CLAUDE_GATEWAY_LOG_LEVEL","slug":"claude-gateway-log-level","description":"Minimum level for the gateway's `[gateway]` log lines written to stderr: `debug`, `info`, `warn` or `error`, case-insensitive. Default `info`; an unset or unrecognised value uses `info`."},{"name":"CLAUDE_GATEWAY_PROXY_IS_EGRESS_BOUNDARY","slug":"claude-gateway-proxy-is-egress-boundary","description":"A new env var lets a gateway proxy handle outbound address safety checks itself instead of Claude Code"}],"url":"https:\/\/changelogs.core-directive.com\/reference\/env\/claude-gateway-allow-loopback","family_url":"https:\/\/changelogs.core-directive.com\/reference\/env.json"}