Claude apps gateway for AWS and GCP
Anthropic ships a self-hosted control plane that adds SSO, central policy, and per-user spend limits to Claude Code on Amazon Bedrock and Google Cloud.
On July 2, Anthropic released the Claude apps gateway, a self-hosted control plane that sits between your identity provider and the Claude inference APIs. It replaces the current setup where each developer keeps their own API key.
The gateway runs as a stateless container backed by a PostgreSQL database. On login, it issues a short-lived session credential and enforces whatever managed settings you have configured. Inference routes to the Claude API, Amazon Bedrock, or Google Cloud Vertex, with optional failover between providers. Because the gateway holds the upstream credential, developers never touch a raw API key.
What it gives operators
Corporate SSO through your existing identity provider makes onboarding and offboarding instant. Role-based access lets you restrict which models or features a group can reach. Spend limits operate at the org, group, or user level, with daily, weekly, and monthly caps. Usage data flows to a collector you operate, so inference traffic stays inside your environment unless you deliberately point the gateway at the Anthropic API rather than Bedrock or Google Cloud.
The gap this fills has been a recurring security-team complaint since Claude Code gained enterprise traction: the tool required developers to manage their own credentials, which created credential sprawl and made consistent policy enforcement difficult. The gateway addresses both without requiring changes to how developers actually use the tool.
This is the same pattern Amazon Web Services has standardized for its AI services through MCP enterprise managed auth, now extended to cover Claude Code specifically. Teams already operating on Bedrock or Vertex AI do not need to change their inference infrastructure; the gateway inserts a policy and auth layer in front of what already works.