What
Pointing the gateway's key-set URL at loopback is now rejected unless CLAUDE_GATEWAY_ALLOW_LOOPBACK is set, because the safe-fetch layer would block every such fetch at runtime anyway. The variable is absent by default and the surrounding errors say it exists for tests and must never be set in production.
Evidence
cri.jwks_url targets loopback but CLAUDE_GATEWAY_ALLOW_LOOPBACK is not set — safeFetch would block every JWKS fetch at runtime. Set the escape (tests) or remove the override.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundleCLAUDE_GATEWAY_ALLOW_LOOPBACK
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up CLAUDE_GATEWAY_ALLOW_LOOPBACK, on Claude Code changelog.
* Improved the Claude apps gateway's loopback error messages to name `CLAUDE_GATEWAY_ALLOW_LOOPBACK`changelog see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up CLAUDE_GATEWAY_ALLOW_LOOPBACK, on Claude Code changelog.