{"version":"2.1.228","anchor":"gateway-can-admit-claude-enterprise-callers-without-its-own-","canonical_anchor":"gateway-can-admit-claude-enterprise-callers-without-its-own-","heading":"Gateway can admit Claude Enterprise callers without its own login (customer-routed inference)","tier":"use","area":"Gateway","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.228\/e\/gateway-can-admit-claude-enterprise-callers-without-its-own-","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.228","markdown":"### Gateway can admit Claude Enterprise callers without its own login (customer-routed inference)\n\nYour gateway can accept Enterprise callers with Anthropic-minted tokens and run without any identity provider.\n\n**What**\n\nThe bundled `claude gateway` gains a `cri` config block. With `cri.enabled: true` it accepts Claude Enterprise callers presenting Anthropic-minted CRI tokens, checked against an organization allowlist you supply, and the `oidc:` sign-in block becomes optional so a gateway can run with no identity provider at all.\n\n**Details**\n\n- `cri.org_allowlist` must list at least one Claude Enterprise organization UUID when `cri.enabled` is true, and entries are validated as UUID-shaped; startup fails otherwise.\n- The `cri` section also carries a policy webhook setting.\n- Discovery advertises `cri_enabled`, and responses are tagged with an `x-cri-upstream-kind` header.\n- Omitting `oidc:` is only permitted for a CRI-only deployment; otherwise config validation rejects it.\n- With no identity provider, the landing page prints `Identity provider (none \u2014 customer-routed inference only)`, `\/oauth\/callback` returns 404, discovery reports `grant_types_supported: []`, and group and scope checks read through an optional oidc block.\n\n**Evidence**\n\n`cri.org_allowlist must list at least one Claude Enterprise organization UUID when cri.enabled is true`, `oidc: not configured (customer-routed inference only)`, `customer-routed-inference-only deployment (cri.enabled: true)`\n\n- Area: Gateway\n- Names: `cri.enabled`, `claude gateway`\n- Tier: Use it now\n- Useful: 3\/5\n- Signal: 5\/5"}