Pointing the gateway key-set URL at loopback is now blocked unless you set CLAUDE_GATEWAY_ALLOW_LOOPBACK, which is for tests only.
What's wrong with this entry?
Pointing the gateway's key-set URL at loopback is now rejected unless CLAUDE_GATEWAY_ALLOW_LOOPBACK is set, because the safe-fetch layer would block every such fetch at runtime anyway. The variable is absent by default and the surrounding errors say it exists for tests and must never be set in production.
cri.jwks_url targets loopback but CLAUDE_GATEWAY_ALLOW_LOOPBACK is not set — safeFetch would block every JWKS fetch at runtime. Set the escape (tests) or remove the override.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.243
Gateway loopback escape hatch is still present
Both mention gateway allow loopback
-
v2.1.228
Gateway customer-routed inference config, disabled by default
Both mention gateway allow loopback