Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.228 Home All releases ←olderv2.1.227 v2.1.229newer→
Claude Code v2.1.228

Gateway can admit Claude Enterprise callers without its own login (customer-routed inference)

Use it now
Useful3 Signal5
Gateway Notable not in their notes

Your gateway can accept Enterprise callers with Anthropic-minted tokens and run without any identity provider.

cri.enabledclaude gateway
What

The bundled claude gateway gains a cri config block. With cri.enabled: true it accepts Claude Enterprise callers presenting Anthropic-minted CRI tokens, checked against an organization allowlist you supply, and the oidc: sign-in block becomes optional so a gateway can run with no identity provider at all.

Details
  • cri.org_allowlist must list at least one Claude Enterprise organization UUID when cri.enabled is true, and entries are validated as UUID-shaped; startup fails otherwise.
  • The cri section also carries a policy webhook setting.
  • Discovery advertises cri_enabled, and responses are tagged with an x-cri-upstream-kind header.
  • Omitting oidc: is only permitted for a CRI-only deployment; otherwise config validation rejects it.
  • With no identity provider, the landing page prints Identity provider (none — customer-routed inference only), /oauth/callback returns 404, discovery reports grant_types_supported: [], and group and scope checks read through an optional oidc block.
Evidence

cri.org_allowlist must list at least one Claude Enterprise organization UUID when cri.enabled is true, oidc: not configured (customer-routed inference only), customer-routed-inference-only deployment (cri.enabled: true)

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Related

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.

See this entry in the whole of v2.1.228 →