{"version":"2.1.233","anchor":"gateway-can-forward-user-identity-headers-plus-a-new-ccr-gat","canonical_anchor":"gateway-can-forward-user-identity-headers-plus-a-new-ccr-gat","heading":"Gateway can forward user identity headers, plus a new ccr-gateway host mode","tier":"use","area":"Gateway","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.233\/e\/gateway-can-forward-user-identity-headers-plus-a-new-ccr-gat","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.233","markdown":"### Gateway can forward user identity headers, plus a new ccr-gateway host mode\n\nGateway upstreams can pass your sanitised identity headers along, and a new ccr-gateway host mode takes its origin from --sdk-url.\n\n**What**\n\nAn upstream configured with `forwardUserIdentity` now has sanitised identity headers, including `x-claude-gateway-user-email`, added to its outbound requests. A new `ccr-gateway` host kind takes its origin from `--sdk-url`.\n\n**Details**\n\n- Config validation warns when `forward_user_identity` is set on a deployment where no session principal can exist, since the headers would then never be sent.\n- `ccr-gateway` reports the same missing-URL and rejected-URL errors as the existing `ccr-session` host kind.\n- Upstream 400 and 413 responses now get their own error-message mapping instead of a generic one.\n\n**Evidence**\n\n`x-claude-gateway-user-email`\n\n- Area: Gateway\n- Names: `forwardUserIdentity`, `--sdk-url`\n- Tier: Use it now\n- Useful: 2\/5\n- Signal: 3\/5"}