Anthropic's new enterprise gateway for Claude Code

Deploying terminal-based coding agents across an engineering team is usually an IT nightmare. Admins have to provision individual cloud credentials, manually sync settings across dozens of laptops, and somehow figure out who racked up a surprise bill on Amazon Bedrock.

Anthropic just launched the Claude Apps Gateway, a self-hosted control plane that fixes the headache for teams running Claude Code on Amazon Bedrock and Google Cloud.

One container, zero long-lived secrets

The gateway deploys as a single stateless container on Linux backed by PostgreSQL.

In a neat engineering move, Anthropic bundled the gateway directly inside the exact same claude CLI binary developers already install on their machines. When developers run the login flow, the client automatically recognizes the gateway and pulls managed settings.

For authentication, the gateway acts as an OIDC relying party. You can hook it straight into Okta, Microsoft Entra ID, or Google Workspace. It issues short-lived session tokens, meaning no long-lived cloud credentials ever touch local developer laptops. Onboarding or offboarding an engineer is now as simple as flipping a switch in your corporate IdP.

Local data retention and multi-cloud failover

Beyond identity, the gateway gives administrators fine-grained control over models, usage, and budgets.

Admins can enforce allowed models centrally on every request. You can also define spend caps across organizations, teams, or individual users on a daily, weekly, or monthly basis.

Telemetry is stamped per request and exported over standard OTLP to your existing internal collectors, completely within your network. Anthropic confirmed that inference traffic and metrics never touch its own servers unless configured to hit the direct Claude API.

As a bonus, the gateway handles upstream credentials and routing across the Claude API, Bedrock, and Google Cloud, with optional automated failover if one provider goes down. Anthropic is also publishing the underlying protocol so third parties can build compatible tools.

Why it matters

This looks like the missing link Anthropic needed to sell Claude Code into traditional enterprise environments.

Companies with existing enterprise commitments on AWS and Google Cloud often loved Claude's reasoning but banned the CLI over audit risks and uncontrolled cloud spend. By resolving single sign-on, centralized policies, and per-seat spend caps in a self-hosted package, Anthropic removes nearly every major procurement roadblock. If your engineering org runs on Bedrock or GCP, this is worth deploying right away.

For the broader industry, it poses a direct threat to GitHub Copilot's corporate stronghold. Bundling the control plane into the CLI binary while supporting multi-cloud failover between AWS and GCP is an exceptionally clever architecture choice.

The only real trade-off is the self-hosted burden. Running containers and managing PostgreSQL database availability is still on your platform engineering team. If the gateway container goes down, coding workflows could halt, but for enterprises obsessed with data privacy, that is a trade-off most will gladly make.