Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.228 Home All releases ←olderv2.1.227 v2.1.229newer→
Claude Code v2.1.228

Self-hosted gateway can admit callers with Anthropic-issued JWTs

Use it now
Useful3 Signal5
Gateway Notable not in their notes

The gateway can authenticate callers with Anthropic-issued JWTs verified against a remote key endpoint.

cri.enabled
What

The gateway server can now accept requests authenticated by cri+jwt-typed ES256 tokens instead of a shared key. Turn it on with cri.enabled: true in the gateway config. Tokens are verified against keys fetched from https://api.anthropic.com/api/oauth/cri, must carry the inference scope and belong to an allowlisted organisation. If the keys cannot be fetched the gateway answers 503 with jwks_unavailable.

Details
  • Fetched keys are cached, honouring the cache-control: max-age header on the key response.
  • Setting cri.jwks_url, or an issuer other than the default, is rejected at startup unless the value is loopback and CLAUDE_GATEWAY_ALLOW_LOOPBACK is set.
  • None of this verification code exists in 2.1.227.
Evidence

cri+jwt

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Related

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.

See this entry in the whole of v2.1.228 →