The self-hosted gateway accepts a strict customer-routed inference config block, off unless you enable it.
A cri config block with issuer, audience and org allowlist is validated but enabled defaults to false.
What's wrong with this entry?
The gateway config schema now accepts a cri block for customer-routed inference, with enabled defaulting to false, plus audience, issuer, org allowlist and an optional policy webhook. Validation is strict: the issuer must be canonical https with no query, fragment or trailing slash, because the key URL is derived as {issuer}/jwks.json. Loopback issuers require CLAUDE_GATEWAY_ALLOW_LOOPBACK. Allowlist entries that are not UUIDs warn that every caller from that org will be denied.
- A
cri:block present withenablednot set to true produces an explicit warning that the config is inert.
cri.issuer must not end with '/'
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.243
Gateway loopback escape hatch is still present
Both mention gateway allow loopback
-
v2.1.238
Loopback JWKS overrides now require an explicit test escape hatch
Both mention gateway allow loopback