Gateway loopback check now also covers cri.issuer and cri.policy.webhook.url, not just cri.jwks_url
The deployment-time check that rejects loopback addresses (like localhost) in gateway configuration still requires the CLAUDE_GATEWAY_ALLOW_LOOPBACK environment variable to be set before it will allow one through. This check now also applies to cri.issuer and cri.policy.webhook.url, in addition to cri.jwks_url.
This widens the same safety net that was already in place for cri.jwks_url to two more configuration fields, so pointing any of these three settings at a loopback address without the escape-hatch variable set will still be treated as a fatal misconfiguration.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
* Improved the Claude apps gateway's loopback error messages to name `CLAUDE_GATEWAY_ALLOW_LOOPBACK`changelog see the edit
Anthropic's documentation has since written up CLAUDE_GATEWAY_ALLOW_LOOPBACK, on Claude Code changelog.