Every laptop with Claude Code on it tends to collect long-lived secrets like lint. A cloud key here, a service credential there, an API token in a dotfile that outlived two employees. That is the surface area we told ourselves was fine, because the alternative was another SSO round trip and a queue of tickets from developers. Anthropic just moved that trade-off. On July 1, DevOps.com (byline Tom Smith) reported that Anthropic has introduced a self-hosted Claude apps gateway for enterprises running Claude Code on Amazon Bedrock or Google Cloud.
What actually shipped
Per DevOps.com, the gateway is a single stateless container backed by a PostgreSQL database. It sits between Claude Code and the two hyperscaler backends, and it acts as an OpenID Connect relying party. That means it federates sign-in through whichever IdP you already run: Google Workspace, Microsoft Entra ID, Okta, or any standards-compliant OIDC provider. The sessions the gateway hands back are short-lived, and they replace the long-lived per-developer secrets that used to live on developer machines to reach the two cloud backends.
The gateway also centralizes identity, policy enforcement, usage tracking and spend management for Claude Code. If you want to know who ran which agent against which model, how much it cost, and whether they were allowed to do that, the gateway is the point in the topology where you find out.
