Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.228 Home All releases ←olderv2.1.227 v2.1.229newer→
Claude Code v2.1.228

Gateway can verify caller identity against an allowlist, off unless configured

Not switched on
Useful2 Signal4
Gateway Notable not in their notes

The gateway can check caller tokens against an organisation allowlist when you enable it in config.

Identity verification runs only when cri.enabled is true in gateway config; the boot path is otherwise unchanged.

cri.enabled
What

The gateway gained an optional identity-verification block named cri, with settings for the expected audience, an allowed-organisation list, and the key and issuer URLs used to check tokens. It only runs when cri.enabled is set to true in gateway config; otherwise the boot path is unchanged.

Details
  • When enabled, the verifier is primed at startup, verified callers are tagged onto upstream requests, and responses for those callers are post-processed.
  • The gateway reads an x-gateway-upstream-kind header off upstream responses.
  • OIDC settings became optional, with the group and email claim names defaulting to groups and email.
  • The two desktop-policy 404 responses now share one error-response helper.
Evidence

x-gateway-upstream-kind

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Related

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.

See this entry in the whole of v2.1.228 →