What
The check that refuses the forward_user_identity option on Anthropic upstreams now covers one more host. A gateway config now fails validation, the check Claude Code runs on the config before using it, when the upstream's base_url host is claude.googleapis.com.
The refused hosts are now:
anthropic.comand any subdomain of it- the AWS external-Anthropic endpoints
claude.googleapis.com, which is the addition
Why
If your gateway config sets forward_user_identity on an upstream pointing at claude.googleapis.com, that config will stop passing validation. The refusal keeps user emails from being sent to Anthropic. Remove the option from that upstream to fix it.
Names in the bundleforward_user_identity
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Added since
A small documentation edit on Claude apps gateway deployment and operations touched a line naming forward_user_identity after this was published.
| Identity (email, groups, sub) | IdP → gateway → CLI; the CLI stamps it on OTLP exports. If you turn on [`forward_user_identity`](/docs/en/claude-apps-gateway-config#per-user-identity-headers-for-a-proxy-you-run), the gateway also sends t…claude-apps-gateway-deploy see the edit
Confirmed since
Anthropic's documentation has since written up forward_user_identity, on Claude apps gateway deployment and operations.
| Identity (email, groups, sub) | IdP → gateway → JWT → CLI; the CLI stamps it on OTLP exports. If you turn on [`forward_user_identity`](/docs/en/claude-apps-gateway-config#per-user-identity-headers-for-a-proxy-you-run), the gateway also s…claude-apps-gateway-deploy see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up forward_user_identity, on Claude apps gateway deployment and operations.