Route Claude Code through the AI Gateway

Send Claude Code, in VS Code or in the terminal, through the WASViking AI Gateway with your organization's Anthropic API key, one gateway key per developer and a gateway set up for coding assistants.

Claude Code can send its model requests through the WASViking^® AI Gateway. Your policies then apply to what developers send, budgets and rate limits cover their usage, and the request log shows each request with the developer who made it.

Before you start

• Billing. Requests through this gateway use your organization's Anthropic API key and are billed per token on that Anthropic account. For developers on Claude Team or Enterprise seats, who keep their own Claude sign-in, see Protect Claude Code on Claude seats.
• An Anthropic API key, created in the Anthropic Console.
• The AI Gateway turned on, as in Protect model API calls.
• Claude Code on the developers' computers, in VS Code or in the terminal.

Step 1: add the Anthropic credential

On Providers & Models, select Add credential, choose Anthropic as the provider, paste the Anthropic API key and save. Select Test on the new row: the provider should accept the key.

Step 2: create a gateway for the coding assistant

On Workloads, select New gateway and set:

What the Coding assistant option changes on this gateway:

• A secret found in a file Claude Code reads, in an earlier message or in the system prompt is replaced with a marker such as [REDACTED:AWS_KEYS] before the request leaves, and the session goes on.
• What the developer types in the newest message follows your policies, so a secret typed into a prompt is still refused when your policy blocks secrets.
• Code is not treated as sensitive data, since it is what a coding assistant works on.

Step 3: add a route

On Routing & Failover, add a route for the gateway with the models claude-*, the Anthropic credential and the role Primary.

Step 4: create one key per developer

On Access & Keys, create a key for each developer and choose the developer in Belongs to. The request log, the budgets and the alerts then show who made each request, and revoking one key affects only that developer.

Step 5: point Claude Code at the gateway

The gateway address for Claude Code is the Anthropic SDKs base URL on the Integrations tab, such as https://api.wasviking.com/ai-gateway/anthropic.

In VS Code, run Preferences: Open User Settings (JSON) and add:

{
  "claudeCode.environmentVariables": [
    { "name": "ANTHROPIC_BASE_URL", "value": "https://api.wasviking.com/ai-gateway/anthropic" },
    { "name": "ANTHROPIC_AUTH_TOKEN", "value": "wvag_the-developer-key" },
    { "name": "CLAUDE_CODE_GATEWAY_HINT_HEADERS", "value": "1" }
  ]
}

In the terminal, add the same values to ~/.claude/settings.json:

{
  "env": {
    "ANTHROPIC_BASE_URL": "https://api.wasviking.com/ai-gateway/anthropic",
    "ANTHROPIC_AUTH_TOKEN": "wvag_the-developer-key",
    "CLAUDE_CODE_GATEWAY_HINT_HEADERS": "1"
  }
}

CLAUDE_CODE_GATEWAY_HINT_HEADERS makes Claude Code say which requests carry what the developer typed. Claude Code also sends its own requests, such as the auto mode safety checks, which repeat earlier messages: with this variable the gateway masks a secret in them instead of refusing them.

To set up a whole team, your IT team can distribute the same values through Claude Code's managed settings and set allowedProviders to ["customEndpoint"], so Claude Code only works through the gateway.

Step 6: check the connection

In Claude Code, run /status. The Anthropic base URL line shows the gateway address and the Auth token line names ANTHROPIC_AUTH_TOKEN. Send a message: it appears on Traffic with the developer's name.

Policies that suit a coding assistant gateway

• Secrets in prompts: Block. It applies to what the developer types; secrets in files are masked by the gateway.
• Personal data: Audit only. Claude Code sends the developer's own e-mail address with each request, and redacting it rewrites every request.
• Prompt injection: Block.
• Source code: not needed. Code does not count as sensitive data on this gateway.

Limits to know

• A gateway that uses gateway keys does not accept a Claude subscription sign-in. Without ANTHROPIC_AUTH_TOKEN set to a gateway key, requests are refused with 401.
• Claude Code features that need a claude.ai sign-in, such as Remote Control and voice dictation, are not available while a gateway key is set.
• /context shows approximate token counts, and the /model picker shows Claude Code's built-in models.

Troubleshooting