A Detailed Look at Claude Apps Gateway on AWS

Claude Apps Gateway is Anthropic's own LLM Gateway built directly into the Claude Code CLI binary. It runs as a server with just the claude gateway --config gateway.yaml command, without needing to install a separate proxy, centralizing authentication, access control, and usage tracking between developers and model providers.

The key difference from existing LLM Gateways like LiteLLM is that it uses company IdP (Okta, Entra ID, Keycloak, etc.) SSO login instead of API Keys. After logging in, authentication is done via a short-lived session token issued by the Gateway, and model access permissions and usage can be controlled at the IdP group level. It also enables dynamically delivering Managed Settings policies per group, which was not possible in pure Bedrock environments.

The main requirements for deploying on AWS are as follows:

• Claude Code v2.1.195 or higher required (both server and client); v2.1.198 or higher when using Claude Platform on AWS instead of Bedrock
• Private Network connection required: Claude Code only allows connections to Gateways that resolve to private IPs (Direct Connect or VPN required)
• HTTPS required: place an ALB or Nginx in front of the Gateway
• Only OIDC-compatible IdPs supported (SAML/LDAP not supported)
• PostgreSQL 14 or higher required (Amazon RDS or Aurora can be used)

Gateway configuration is managed via gateway.yaml, declaratively configuring the OIDC issuer, upstream (Bedrock region, IAM), model list, usage limits, and more.