{"version":"2.1.228","anchor":"self-hosted-gateway-can-admit-callers-with-anthropic-issued-","canonical_anchor":"self-hosted-gateway-can-admit-callers-with-anthropic-issued-","heading":"Self-hosted gateway can admit callers with Anthropic-issued JWTs","tier":"use","area":"Gateway","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.228\/e\/self-hosted-gateway-can-admit-callers-with-anthropic-issued-","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.228","markdown":"### Self-hosted gateway can admit callers with Anthropic-issued JWTs\n\nThe gateway can authenticate callers with Anthropic-issued JWTs verified against a remote key endpoint.\n\n**What**\n\nThe gateway server can now accept requests authenticated by `cri+jwt`-typed ES256 tokens instead of a shared key. Turn it on with `cri.enabled: true` in the gateway config. Tokens are verified against keys fetched from `https:\/\/api.anthropic.com\/api\/oauth\/cri`, must carry the `inference` scope and belong to an allowlisted organisation. If the keys cannot be fetched the gateway answers 503 with `jwks_unavailable`.\n\n**Details**\n\n- Fetched keys are cached, honouring the `cache-control: max-age` header on the key response.\n- Setting `cri.jwks_url`, or an issuer other than the default, is rejected at startup unless the value is loopback and `CLAUDE_GATEWAY_ALLOW_LOOPBACK` is set.\n- None of this verification code exists in 2.1.227.\n\n**Evidence**\n\n`cri+jwt`\n\n- Area: Gateway\n- Names: `cri.enabled`\n- Tier: Use it now\n- Useful: 3\/5\n- Signal: 5\/5"}