{"slug": "claude-apps-gateway-sso-and-spend-caps-for-claude-code-on-aws", "title": "Claude Apps Gateway: SSO and Spend Caps for Claude Code on AWS", "summary": "Anthropic launched the Claude Apps Gateway, a self-hosted control plane for Claude Code on AWS that replaces scattered API credentials with corporate SSO and real-time spend controls. The gateway sits between developer clients and model providers like Amazon Bedrock, enforcing spend limits at the organization, group, or individual level via an admin API. It requires a private IP address and disables web search and 1-hour prompt cache TTL.", "body_md": "If you run a dev team of any size, you know how this goes. Claude Code rolls out. Developers add their API keys to `.bash_profile`\n\n. Usage explodes. Finance asks how much you spent last month. Someone leaves. Nobody is sure if their credential is still active somewhere. On June 29, Anthropic shipped a direct answer: the **Claude Apps Gateway**, a self-hosted control plane that replaces scattered API credentials with corporate SSO and real spend controls.\n\n## What It Actually Does\n\nThe gateway sits between your developers’ Claude Code clients and your model provider—Amazon Bedrock, Google Cloud, Microsoft Foundry, or the Anthropic API directly. Developers sign in with your corporate identity provider (Okta, Google Workspace, Microsoft Entra ID, or any [OIDC-compliant IdP](https://openid.net/developers/how-connect-works/)) instead of holding cloud credentials. The gateway holds the upstream credential and issues short-lived tokens. When someone leaves, deprovision them in the IdP. Their gateway access expires within the session TTL—one hour by default. No API key hunting required.\n\nIt ships inside the same `claude`\n\nbinary your team already uses. Run it with `claude gateway --config gateway.yaml`\n\non a Linux host backed by PostgreSQL 14+.\n\n## Getting It Running\n\nThe setup is five steps: register an OIDC application in your IdP, provision a Postgres database, write a `gateway.yaml`\n\n, deploy with Docker Compose (or Kubernetes/Cloud Run for production), and verify sign-in. The minimal config covers most setups:\n\n```\nlisten:\n  public_url: https://claude-gateway.internal.example.com\n\noidc:\n  issuer: https://login.example.com\n  client_id: 0oa1example2\n  client_secret: ${OIDC_CLIENT_SECRET}\n  allowed_email_domains: [example.com]\n\nsession:\n  jwt_secret: ${GATEWAY_JWT_SECRET}\n  ttl_hours: 1\n\nstore:\n  postgres_url: ${GATEWAY_POSTGRES_URL}\n\nupstreams:\n  - provider: bedrock\n    region: us-east-1\n    auth: {}\n\nauto_include_builtin_models: true\n```\n\nOne requirement worth noting: the gateway must resolve only to a private IP address. Claude Code rejects public IPs at `/login`\n\nas a security control—a gateway that can push managed settings to developer machines cannot be reachable from the public internet.\n\nPush these two settings to developer machines via MDM and they connect automatically on next boot:\n\n```\n{\n  \"forceLoginMethod\": \"gateway\",\n  \"forceLoginGatewayUrl\": \"https://claude-gateway.internal.example.com\"\n}\n```\n\n## Spend Controls That Actually Work\n\nThe gateway’s spend limits are its most immediately useful feature for most teams. Set caps at the organization, group, or individual level through an admin API—and the gateway enforces them live on every inference request. A developer who hits their cap gets a 429 until the period resets or an admin raises the limit.\n\n```\n# $500/month org-wide default\ncurl -X POST https://claude-gateway.internal.example.com/v1/organizations/spend_limits \\\n  -H \"x-api-key: $ADMIN_KEY\" \\\n  -d '{\"scope\": {\"type\": \"organization\"}, \"amount\": \"50000\", \"period\": \"monthly\"}'\n\n# $100/day cap for contractors\ncurl -X POST https://claude-gateway.internal.example.com/v1/organizations/spend_limits \\\n  -H \"x-api-key: $ADMIN_KEY\" \\\n  -d '{\"scope\": {\"type\": \"rbac_group\", \"rbac_group_id\": \"contractors\"}, \"amount\": \"10000\", \"period\": \"daily\"}'\n```\n\nThe spend API mirrors Anthropic’s [public Admin API](https://platform.claude.com/docs/en/manage-claude/admin-api) contract, so existing tooling targeting that API works by swapping the base URL. One caveat: these limits are circuit breakers, not billing sources of truth. Reconcile actual spend against your Bedrock or GCP invoices—the gateway estimates from token counts at list price.\n\n## What You Give Up\n\nA few features do not work through the gateway, and it is worth knowing them before you start the migration:\n\n**Web search:** Disabled. The CLI cannot verify which upstream supports it, so it turns web search off for all gateway sessions.**1-hour prompt cache TTL:** Unavailable. You get the standard 5-minute TTL. Not every upstream the gateway routes to supports the extended TTL, so it is omitted.**CI service tokens:** Not supported. The gateway requires the browser device flow. There is no machine credential path. CI jobs must authenticate directly against your cloud provider. This is the most significant limitation for teams hoping to centralize everything.**Admin UI:** None. Configuration is YAML only—redeploy to change settings.**SAML or LDAP:** Not supported. OIDC-compliant providers only.\n\n## Gateway or Claude Enterprise?\n\nBefore you start deploying, check if you actually need the gateway. If your organization does not have a data-residency requirement that forces inference through Bedrock or GCP, [Claude Enterprise](https://www.anthropic.com/enterprise) (via the claude.ai admin console) is probably the better choice. You get SCIM provisioning, Claude Code on web and mobile, and simpler setup—no self-hosted container to run.\n\nThe gateway is specifically for organizations where inference traffic must stay in their cloud environment. If that is you, it is the right call. If it is not, Claude Enterprise gives you most of the same governance features with significantly less operational overhead.\n\n## The Part It Does Not Solve\n\nMitch Ashley at The Futurum Group put it plainly: \"This makes one coding tool manageable at scale. It does not govern what agents do.\" The gateway solves credential sprawl and spend visibility. It does not tell you what an agent running in Auto mode actually did with the production credentials it was handed. As Claude Code increasingly operates autonomously—running bash commands, modifying files, calling external APIs—the gap between access governance and behavioral governance is where the next set of hard problems lives.\n\nFor now, the gateway is a clean solution to a real problem. If you are running Claude Code across a team of more than a dozen developers on Bedrock or GCP, it is worth an afternoon to deploy. The [official announcement](https://claude.com/blog/introducing-the-claude-apps-gateway) and [full documentation](https://code.claude.com/docs/en/claude-apps-gateway) are the right starting points. AWS teams should also check the [AWS blog post](https://aws.amazon.com/blogs/machine-learning/introducing-claude-apps-gateway-for-aws/); GCP teams the [Google Cloud announcement](https://cloud.google.com/blog/topics/developers-practitioners/announcing-claude-apps-gateway-for-google-cloud). The [spend limits documentation](https://code.claude.com/docs/en/claude-apps-gateway-spend-limits) is worth bookmarking before your first deployment.", "url": "https://wpnews.pro/news/claude-apps-gateway-sso-and-spend-caps-for-claude-code-on-aws", "canonical_source": "https://byteiota.com/claude-apps-gateway-sso-spend-caps-claude-code/", "published_at": "2026-07-11 18:12:52+00:00", "updated_at": "2026-07-11 18:22:42.042741+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "ai-infrastructure", "ai-products"], "entities": ["Anthropic", "Claude Code", "Amazon Bedrock", "Google Cloud", "Microsoft Foundry", "Okta", "Google Workspace", "Microsoft Entra ID"], "alternates": {"html": "https://wpnews.pro/news/claude-apps-gateway-sso-and-spend-caps-for-claude-code-on-aws", "markdown": "https://wpnews.pro/news/claude-apps-gateway-sso-and-spend-caps-for-claude-code-on-aws.md", "text": "https://wpnews.pro/news/claude-apps-gateway-sso-and-spend-caps-for-claude-code-on-aws.txt", "jsonld": "https://wpnews.pro/news/claude-apps-gateway-sso-and-spend-caps-for-claude-code-on-aws.jsonld"}}