Claude Apps Gateway: Centralize AI Governance on GCP

Anthropic’s Claude Code has been swimming in Google Cloud waters for a while, but managing it across an org was like herding capybaras through a swamp—lots of per-developer credentials, manual config pushes, and zero visibility into usage. Enter the Claude apps gateway: a self-hosted service that sits between your local Claude Code clients and Google Cloud, centralizing identity, policy, cost, and routing. Let’s dive into why you need it and how to set it up.

Why Run the Gateway?

Instead of each developer wrestling with cloud credentials and managed-settings.json, the gateway gives you a single point of control. Here’s what it handles:

• Identity: Routes through your IdP (Google Workspace or any OIDC). No service-account keys on laptops—onboarding is adding a user to a group; offboarding is removing them.
• Policy: RBAC rules live in gateway.yaml, enforced server-side. Editing local config does nothing; updates reach the whole fleet within an hour.
• Telemetry: Every token usage metric carries the verified email and groups from the session JWT—no spoofable client attributes.
• Spend limits: Set daily/weekly/monthly caps per user or group. The gateway meters tokens against a Cloud SQL ledger and returns a 429 at the cap.
• Routing: All calls go out under a single Cloud Run service identity. Inference stays in your GCP project—quota, DPA, and billing unchanged.

How It Fits Together

A developer’s Claude Code process sends inference traffic to the gateway over HTTPS. The gateway is a stateless container on Cloud Run that validates the session bearer, checks policy, and forwards requests to Agent Platform using the Cloud Run service account. Cloud SQL holds device-code sign-in state and the spend ledger; an OTLP collector receives attributed metrics.

Setting It Up on Google Cloud

The full walkthrough is in the official docs, but here’s the short version:

Step 1: Provision the GCP Foundation

Enable Agent Platform, Cloud SQL, and Secret Manager APIs. Create a claude-gateway service account with roles/aiplatform.user. Stand up a small Cloud SQL Postgres instance. Create a new OAuth client (type Web application) in Google Cloud console for OIDC handshake.

Step 2: Configure the Gateway

Write gateway.yaml pointing at your Google Workspace OIDC client, Postgres connection string, and Agent Platform as upstream. Store it in Secret Manager along with the OIDC client secret, Postgres URL, and a JWT signing key.

listen:
  port: 8080
  public_url: https://<your-cloud-run-service-url>
oidc:
  issuer: https://accounts.google.com
  client_id: <client-id>.apps.googleusercontent.com
  client_secret: ${OIDC_CLIENT_SECRET}
  allowed_email_domains: [yourco.com]
upstreams:
  - provider: vertex
    region: us-east5
    project_id: <your-project>
    auth: {}

Register https://<public_url>/oauth/callback as an authorized redirect URI on the Google OAuth client.

Step 3: Deploy to Cloud Run

Run gcloud run deploy with the service account attached, Cloud SQL connection on VPC, and config mounted from Secret Manager. The container is stateless and scales horizontally.

gcloud run deploy claude-gateway 
  --service-account="claude-gateway@${PROJECT_ID}.iam.gserviceaccount.com" 
  --set-secrets=/etc/claude/gateway.yaml=gateway-config:latest 
  --ingress=internal 
  --no-invoker-iam-check

Step 4: Onboard a Developer

Push forceLoginMethod: "gateway" and forceLoginGatewayUrl to developer machines via managed settings (or manually for testing). At Claude Code startup, the developer confirms the gateway URL, completes device-code flow in the browser against Google Workspace, and they’re in.

What’s Next

Check out the full config reference and deployment docs for per-IdP setup and GKE tracks. For group-scoped policies, front the gateway with a groups-capable IdP and add match: { groups: [...] } policies. Happy building!

Original announcement published on Google Cloud.