What probably matters to youSection of the release
What
The gateway server can now accept requests authenticated by cri+jwt-typed ES256 tokens instead of a shared key. Turn it on with cri.enabled: true in the gateway config. Tokens are verified against keys fetched from https://api.anthropic.com/api/oauth/cri, must carry the inference scope and belong to an allowlisted organisation. If the keys cannot be fetched the gateway answers 503 with jwks_unavailable.
Details
Fetched keys are cached, honouring the cache-control: max-age header on the key response.
Setting cri.jwks_url, or an issuer other than the default, is rejected at startup unless the value is loopback and CLAUDE_GATEWAY_ALLOW_LOOPBACK is set.
None of this verification code exists in 2.1.227.
Evidence
cri+jwt
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
