Agents & CLIs · Client configuration

Run Claude Code through a governed Claude route.

Give Claude Code a separate gateway credential, a hard budget, and an approved Claude route without exposing the provider key.

Create a free workspace Try the no-card Test Lab

How the connection works

How Claude Code works with the gateway

Know which account pays

ANTHROPIC_AUTH_TOKEN replaces the saved claude.ai login while it is set. Unset the variable to return to the saved login. The current gateway path does not import, share, or spend a Claude Pro, Max, Team, or Enterprise allowance.

Preserve the Claude Code protocol

Claude Code adds capabilities over time. Production acceptance must prove that version and beta headers, request fields, streamed events, keep-alive pings, and upstream errors survive the route without incompatible rewriting.

Configure each client surface separately

The example configures the Claude Code CLI. VS Code, the desktop app, GitHub Actions, and Anthropic-hosted cloud sessions use different configuration paths or have different gateway limits; the shell variables do not cover every surface.

Runnable client path

Connect Claude Code while keeping provider secrets off the machine.

Use the Messages-compatible boundary while AI Gateway HQ applies the selected route, budget, and policy before provider access.

Test the controls first

1
Create a Claude Code workload
Give each environment or agent its own key. Set the Claude Code budget, rate limit, route, and fallback first.
2
Keep the key out of configuration files
Store the Claude Code workload key in a keychain, CI secret, or secrets manager. The example contains no real credential.
3
Test both success and failure
Send a small Claude Code request and inspect its receipt. Test Claude Code's zero-balance stop and provider fallback too.

Personal subscription allowances are not imported.

Claude Code uses an AI Gateway HQ workload key. Requests from Claude Code charge the BYOK provider account or prepaid Bedrock balance selected by the route, not a personal subscription allowance.

Claude Code configuration

export AIGHQ_API_KEY='paste-your-workload-key'

ANTHROPIC_BASE_URL=https://api.aigatewayhq.com \
ANTHROPIC_AUTH_TOKEN="$AIGHQ_API_KEY" \
claude --model company-approved-fast

Use the Claude Code production URL shown. For Claude Code, replace only the workload key and approved alias from the customer console.

This Claude Code setup was checked against the vendor's published interface. Before a broad Claude Code rollout, review the primary documentation because the vendor can change its interface.

Current shared controls

What every supported connection includes

Encrypted BYOK credentials that remain hidden after setup Stable model aliases and compatible route targets Organization and key budgets, rate limits, and concurrency limits Observe, Shadow, and Enforce modes with metadata-only evidence

Test the installed Claude Code version, direct Messages request, /status result, streamed events and keep-alive pings, tool round trips, hard budget stop, and compatible Claude fallback before normal use.

Client boundary

ANTHROPIC_BASE_URL=https://api.aigatewayhq.com
ANTHROPIC_AUTH_TOKEN=from-your-workspace
AIGHQ_MODEL=company-approved-fast

Claude Code CLI sends Messages requests to the stable gateway URL with a scoped workload key and approved Claude alias. Administrators can change an eligible Claude provider or compatible Claude fallback centrally. Anthropic does not support routing Claude Code to non-Claude models through a gateway.

Implemented boundary

Supported protocols

Export ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN in a test shell first. Confirm both in Claude Code's /status view, then distribute them with approved user or managed settings and secrets tooling.

POST /v1/messages Messages SSE streaming CLI environment or managed settings

Compatibility follows the provider's current published interface. Review the provider documentation before approving Claude Code for production.