{"version":"2.1.284","anchor":"gateway-login-can-accept-hosts-vouched-for-by-a-recognized-c","canonical_anchor":"gateway-login-can-accept-hosts-vouched-for-by-a-recognized-c","heading":"Gateway hosts can be vouched for by a recognized Claude gateway deployment","tier":"notice","area":"Gateway","url":"https:\/\/changelogs.core-directive.com\/v\/2.1.284\/e\/gateway-login-can-accept-hosts-vouched-for-by-a-recognized-c","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.284","markdown":"### Gateway hosts can be vouched for by a recognized Claude gateway deployment\n\nGateway addresses that fail the local checks can now be accepted if a recognized Claude gateway deployment vouches for them, using the session's login token\n\n**Unclear.** It is not clear which login steps use this confirmation or whether a switch controls it.\n\n**What**\n\nA gateway is a server an organization sets up for Claude traffic to pass through. Checking whether a gateway address is trusted used to be only a local comparison against `forceLoginGatewayUrl` or `gatewayInternalNetworks`. Now:\n\n- For an https gateway host that is not on the built-in list (`claude.fedstart.com`, `claude.palantirfedstart.com`) and fails the normal checks, Claude Code asks the host at `\/gateway-api\/gateway-hosts\/check` which deployment serves it.\n\n- It then confirms with that deployment using a client certificate. The host is accepted only if the deployment lists it and reports that DNS (the system that turns names into addresses) points at it. Accepted hosts are logged as \"accepted: vouched for by\".\n\n- A host that `forceLoginGatewayUrl` does not name is refused unless it is vouched for.\n\n- The check sends the session's login token (`Bearer` plus the session JWT) and the managed login pins (`hostLoginPins`).\n\n- The check can run through a proxy, handling a proxy login request (HTTP 407) with `proxyAuthHelper`. It has timeouts, with messages such as \"could not be confirmed as a recognized Claude gateway host within\", and each failure has its own message, for example when the gateway address carries a query, fragment or user name.\n\n**Why**\n\nOrganizations can reach Claude gateways at hostnames beyond the two built in, without listing every address in settings. If a host is refused, the message says which step of the check failed.\n\n- Area: Gateway\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5"}