Gateway upstreams can pass your sanitised identity headers along, and a new ccr-gateway host mode takes its origin from --sdk-url.
What's wrong with this entry?
An upstream configured with forwardUserIdentity now has sanitised identity headers, including x-claude-gateway-user-email, added to its outbound requests. A new ccr-gateway host kind takes its origin from --sdk-url.
- Config validation warns when
forward_user_identityis set on a deployment where no session principal can exist, since the headers would then never be sent. ccr-gatewayreports the same missing-URL and rejected-URL errors as the existingccr-sessionhost kind.- Upstream 400 and 413 responses now get their own error-message mapping instead of a generic one.
x-claude-gateway-user-email
Strings lifted out of the shipped bundle, so the claim above can be checked against them.