Under the hoodTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
ElsewhereArea: what it touches
Internal ChangesKind: in v2.1.265,
Internal ChangesSection of the release
What
The deployment-time check that rejects loopback addresses (like localhost) in gateway configuration still requires the CLAUDE_GATEWAY_ALLOW_LOOPBACK environment variable to be set before it will allow one through. This check now also applies to cri.issuer and cri.policy.webhook.url, in addition to cri.jwks_url.
Why
This widens the same safety net that was already in place for cri.jwks_url to two more configuration fields, so pointing any of these three settings at a loopback address without the escape-hatch variable set will still be treated as a fatal misconfiguration.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed sinceAnthropic's documentation has since written up CLAUDE_GATEWAY_ALLOW_LOOPBACK, on Claude Code changelog.* Improved the Claude apps gateway's loopback error messages to name `CLAUDE_GATEWAY_ALLOW_LOOPBACK`changelogsee the edit
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agreesAnthropic's documentation has since written up CLAUDE_GATEWAY_ALLOW_LOOPBACK, on Claude Code changelog.
