5 Best Claude Code Gateways for Your Own Infrastructure in 2026

TL;DR

• A Claude Code gateway is a self-hosted service that Claude Code reaches through ANTHROPIC_BASE_URL, holding the provider credential while each developer holds only a gateway credential.
• Bifrost routes Claude Code through virtual keys with per-developer budgets, CEL routing rules, request logs, and a single governed /mcp endpoint, adding 11 microseconds of overhead per request at 5,000 RPS.
• Anthropic’s Claude apps gateway ships inside the claude binary with SSO sign-in and per-developer spend limits, but it serves Claude models only and does not govern MCP tool traffic.
• Kong AI Gateway, Azure API Management, and MLflow AI Gateway differ most on where per-developer budgets live and whether developers keep their own Anthropic credentials.
• A gateway must forward the anthropic-beta and anthropic-version headers and stream responses unbuffered, or Claude Code features break without an obvious error.

Claude Code sends every model request to whatever address ANTHROPIC_BASE_URL holds, which makes a Claude Code gateway the single control point for credentials, spend, and audit across an engineering organization. Bifrost, the open-source AI gateway built in Go by Maxim AI, is the best choice for enterprises running mission-critical AI workloads that require best-in-class performance, scalability, and reliability, and it runs entirely inside your own network. This guide compares five gateways you can self-host for Claude Code on how developers connect, per-developer budgets, model routing, audit, and MCP governance.

How a Claude Code Gateway Works

A Claude Code gateway is a service in your infrastructure that receives Claude Code’s API traffic, authenticates the developer, applies budget and access rules, and forwards the request to a model provider using an organization-held credential. Developers configure two values, a base URL and a gateway credential, and never hold the provider key.

Figure 1: Developers hold only a gateway credential; the provider credential, budgets, and logs stay inside your network.

Anthropic’s gateway overview for Claude Code describes the split in Figure 1: a developer credential per person, and one provider credential the gateway holds. For a longer walkthrough, see our explainer on Claude Code gateway routing, governance, and cost control.

The Claude Code environment variables that matter

Claude Code reads its gateway configuration from environment variables, set in a shell or in a settings file’s env block:

Two details catch teams during rollout. Setting only ANTHROPIC_BASE_URL without a credential variable keeps a developer’s saved claude.ai login active, so subscription billing still applies. And the credential never belongs in a project’s committed .claude/settings.json; use ~/.claude/settings.json or managed settings pushed through device management.

What the gateway has to forward

Anthropic’s gateway compatibility guide sets the requirements: forward anthropic-beta and anthropic-version unchanged, treat new beta values as an open list, and stream without buffering. Claude Code aborts a stream that stays silent for 300 seconds, so stripping upstream ping events breaks long reasoning pauses. Claude Code also sends x-claude-code-session-id on every request, which a gateway can use to group a session’s traffic.

Key Criteria for Evaluating a Claude Code Gateway

The right Claude Code gateway depends on five questions: who holds the provider credential, where per-developer budgets are enforced, which models and clouds requests can reach, what gets logged, and whether MCP tool calls pass through the same control point as model calls. Deployment location and upgrade cadence decide the rest.

Our breakdown of governing Claude Code token usage per team goes deeper on budget design.

Claude Code Gateways Compared at a Glance

The five gateways below all document a Claude Code setup and all run on infrastructure you operate. They differ on budget scope, non-Claude model support, and MCP. Where a vendor page read for this guide did not state a capability, the cell says “Not published.” The Bifrost docs list the full feature set behind the first column.

1. Bifrost

Bifrost, the open-source AI gateway, is what Claude Code reaches through its Anthropic-compatible endpoint, authenticating each developer with a virtual key. It enforces per-developer budgets, rewrites model aliases with routing rules, logs every request, and exposes connected MCP tools through one /mcp endpoint. It runs self-hosted, in-VPC, or on-premises.

Best for: Bifrost is built for enterprises running mission-critical AI workloads that require best-in-class performance, scalability, and reliability. It serves as a centralized AI gateway to route, govern, and secure all AI traffic across models and environments with ultra low latency. Bifrost unifies LLM gateway, MCP gateway, and Agents gateway capabilities into a single platform. Designed for regulated industries and strict enterprise requirements, it supports air-gapped deployments, VPC isolation, and on-prem infrastructure. It provides full control over data, access, and execution, along with robust security, policy enforcement, and governance capabilities.

Connecting Claude Code to Bifrost

The Claude Code integration takes four values in the env block of settings.json:

"env": {
  "ANTHROPIC_BASE_URL": "http://localhost:8080/anthropic",
  "ANTHROPIC_AUTH_TOKEN": "your-virtual-key",
  "ANTHROPIC_DEFAULT_SONNET_MODEL": "sonnet-model",
  "ANTHROPIC_DEFAULT_HAIKU_MODEL": "haiku-model"
}

With ANTHROPIC_AUTH_TOKEN set to a Bifrost virtual key, developers need no Anthropic login or credentials; billing runs through the virtual key. The Bifrost CLI automates this: it configures the base URL, key, and model, stores virtual keys in the OS keyring, and attaches the Bifrost MCP server. Since Claude Code 2.1.212, the Bifrost allowed-headers list should include anthropic-version and related headers, or be set to *.

Model routing for Claude Code

Figure 2: The alias Claude Code sends is rewritten at request time, so changing the target model never touches a developer machine.

In the configuration above, sonnet-model is an arbitrary label. A routing rule written in CEL matches that model name and a user-agent starting with claude-cli, then rewrites it to a target such as vertex/claude-sonnet-4-6. Rules are scoped by virtual key, team, customer, or global, most specific first, so one team can land on Bedrock while another stays on the Anthropic API behind the same alias. Models can also be pinned directly, as in bedrock/global.anthropic.claude-sonnet-4-6.

Session affinity adopts the x-claude-code-session-id header, keeping a session and its subagents on the provider and key that warmed the prompt cache. Bifrost can also route Claude Code to non-Claude models across 25+ supported providers, provided the model supports the tool calling Claude Code relies on; Anthropic itself does not support running Claude Code against non-Claude models, so treat that path as an engineering decision you own. Our guide to using Claude Code with non-Anthropic models covers the trade-offs.

Governance, audit, and deployment

• Per-developer budgets: virtual keys carry budgets with reset durations from one minute to one year, plus token and request rate limits.
• Request logs: built-in observability records inputs, outputs, tool calls, tokens, latency, and provider, with OTLP and Prometheus export.
• Audit logs: Bifrost Enterprise audit logs record administrative activity, can be HMAC-signed, and export as JSON, JSON Lines, or Syslog.
• Identity: OIDC and SCIM provisioning maps IdP groups to teams and roles.
• Deployment: in-VPC deployments and on-premises images keep prompts and logs inside your network.

Bifrost adds 11 microseconds of overhead per request at 5,000 RPS with a 100% success rate in sustained benchmarks. The Claude Code on Bifrost overview summarizes the setup for platform teams.

2. Claude Apps Gateway (Anthropic)

Claude apps gateway is Anthropic’s own self-hosted gateway, built into the claude binary and started with claude gateway --config gateway.yaml. Developers sign in through corporate OIDC SSO instead of holding keys, and the gateway enforces per-group model allowlists, managed settings, and per-developer spend limits against Claude models on your chosen cloud.

Best for: Organizations standardized on Claude models that must keep inference on their own Amazon Bedrock, Google Cloud, or Microsoft Foundry account and want SSO sign-in with no API keys on laptops.

Key characteristics, from Anthropic’s Claude apps gateway documentation:

• Requires Claude Code v2.1.195 or later, PostgreSQL 14 or later, an OIDC identity provider, and a Linux server runtime.
• Routes to Amazon Bedrock, Claude Platform on AWS, Google Cloud’s Agent Platform, Microsoft Foundry, or the Anthropic API, with failover between upstreams.
• Spend limits cap each developer by day, week, or month, scoped by user, IdP group, or organization, and return 429 when exceeded.
• Emits OTLP metrics with token counts, model, user identity, and latency; logs and traces are opt-in per destination.

The trade-offs follow from its scope. It routes Claude models only, there is no service-token flow for CI pipelines, and the one-hour prompt cache TTL is unavailable on gateway sessions. MCP servers are governed through managed-settings allowlists on each client rather than proxied, a gap covered in our guide to using an MCP gateway with Claude Code.

3. Kong AI Gateway

Kong AI Gateway is the AI layer of Kong’s API platform. Kong’s Claude Code guides define an AI Model Provider and an AI Model with kongctl, then point ANTHROPIC_BASE_URL at the local data plane. A separate cookbook adds Okta SSO through apiKeyHelper, group-based model routing, and per-tier token rate limits.

Best for: Teams that already run Kong for API traffic and want Claude Code governed by the same plugins, consumer groups, and Konnect control plane.

What Kong’s documentation shows for Claude Code:

• Separate how-to guides route Claude Code to Anthropic, AWS Bedrock, Azure, and OpenAI upstreams.
• The Anthropic guide launches Claude Code with ANTHROPIC_BASE_URL=http://localhost:8000/ and CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1.
• The SSO cookbook combines the OpenID Connect, AI Proxy Advanced, and AI Rate Limiting Advanced plugins so no provider credential sits on developer machines.
• The AI MCP Proxy plugin bridges MCP and HTTP services, and is available only in the AI Gateway Enterprise offering.

Two constraints matter for self-hosting. Kong’s Claude Code tutorials run against a Konnect control plane and are marked incompatible with on-prem deployments, and spend control is expressed as token rate limits per consumer group rather than a dollar budget per developer. Our overview of how a Claude Code gateway handles cost control compares the two models.

4. Azure API Management AI Gateway (Microsoft)

Azure API Management’s AI gateway is a set of LLM policies inside Microsoft’s API gateway rather than a separate product. It governs language model APIs that follow the OpenAI, Anthropic Messages, or Google Vertex AI schemas, and Microsoft has published a reference setup that puts it between Claude Code and Claude models deployed in Microsoft Foundry.

Best for: Enterprises already standardized on Azure that run Claude through Microsoft Foundry and want Claude Code traffic governed by the same API Management instance, policies, and Azure Monitor workspace as their other APIs.

What Microsoft’s documentation and reference setup show for Claude Code:

• Anthropic Messages API support is currently limited to API Management v2 tiers; requests stay in native Messages format, including streaming and token counting.
• Claude Code runs in its Foundry mode with the base URL pointed at API Management, and each developer authenticates with an API Management subscription key instead of a Foundry key.
• API Management strips client credentials and authenticates to Foundry with its system-assigned managed identity.
• The llm-token-limit policy sets tokens-per-minute limits or token quotas per subscription key or custom counter key, and llm-emit-token-metric sends per-consumer token metrics to Application Insights.

Limits are expressed in tokens rather than dollars, and the Claude Code setup is a Microsoft reference architecture rather than a dedicated product guide, so confirm header forwarding before rollout. The AI gateway capabilities overview lists the available policies, including support for exposing and governing existing MCP servers. Bifrost reaches self-hosted backends such as vLLM and Ollama, with virtual key budgets applied to that traffic.

5. MLflow AI Gateway

MLflow AI Gateway is built into the MLflow tracking server. Starting in MLflow 3.12.0, Claude Code routes through a gateway endpoint by setting ANTHROPIC_BASE_URL to http://localhost:5000/gateway/proxy/claude-code, and every request is captured as an MLflow trace with prompts, responses, token counts, and latency.

Best for: Data and ML teams already running MLflow that want trace-level visibility into Claude Code sessions with minimal setup.

The design is pass-through. Each developer keeps their own Anthropic credentials, and the gateway adds tracing, guardrails, and budget policies on top. Budget policies apply globally or per workspace, with alerts and hard limits. Guardrails can screen requests for PII or prompt injection before they reach Anthropic. Because billing stays on individual accounts, MLflow AI Gateway suits visibility more than centralized credential control, a distinction the LLM gateway buyer’s guide treats as a first-order requirement.

Claude Code Cost Control with Per-Developer Budgets

Claude Code cost control works best when every developer has an individual budget checked before the request reaches the model, with team and organization ceilings layered above it. A per-developer key makes spend attributable; a reset period keeps it bounded; a rejection before forwarding prevents the overrun rather than reporting it afterward.

Figure 3: Every applicable budget must pass, so a developer cap and a team cap enforce independently on the same request.

In the Bifrost AI gateway, Figure 3 maps to the budget and limits hierarchy: cost is calculated from provider pricing, token usage, and cache status, then deducted from the virtual key, team, customer, and provider-config budgets at once. Providers that exceed their own budget or rate limits are excluded from routing for that request. The governance overview for Bifrost shows how these layers fit an enterprise rollout.

The Claude apps gateway reaches a similar outcome differently: group and organization caps are per-seat defaults each member inherits, and Anthropic describes the amounts as estimates to reconcile against provider billing. Kong expresses limits as tokens per consumer group, and MLflow applies them per workspace. For cost attribution patterns across these approaches, see tracking Claude Code costs with an AI gateway.

Claude Code Monitoring, Audit, and MCP Governance

Claude Code monitoring needs two records: request logs that show what each developer sent, and audit logs that show who changed gateway policy. MCP adds a third surface, because Claude Code’s tool calls reach GitHub, databases, and internal APIs, and those calls need the same identity and filtering as model requests.

Figure 4: One MCP entry replaces a config line per server, and the virtual key decides which tools each developer can call.

Bifrost as an MCP gateway aggregates every connected MCP server behind /mcp. Claude Code adds it with one command:

claude mcp add --transport http bifrost http://localhost:8080/mcp \
  --header "Authorization: Bearer your-virtual-key" --scope user

MCP tool filtering is deny-by-default: a virtual key with no MCP configuration exposes no tools except from clients marked allow-by-default, and the allow-list is enforced again at execution time. Per-user OAuth lets each developer authorize their own upstream accounts. The Bifrost MCP gateway resource page covers Code Mode and token savings, and our practical guide to connecting Claude Code to an MCP gateway walks through the setup.

For audit, keep the records distinct: request logs capture traffic and attribution, while Bifrost Enterprise audit logs capture administrative changes to keys, budgets, and policies. For the security side of this model, read our analysis of securing Claude Code agent access with an AI gateway.

Frequently Asked Questions

What is a Claude Code gateway?

A Claude Code gateway is a service your organization runs between Claude Code and a model provider. Claude Code sends requests to the gateway’s address through ANTHROPIC_BASE_URL, authenticates with a gateway-issued credential, and the gateway forwards traffic with the organization’s provider credential while applying budgets, routing, and logging in one place.

How to set a Claude proxy for Claude Code?

Set ANTHROPIC_BASE_URL to the gateway address and put the gateway credential in ANTHROPIC_AUTH_TOKEN (bearer header) or ANTHROPIC_API_KEY (x-api-key header). Put both in the env block of ~/.claude/settings.json so they persist, and run /status to confirm the base URL and credential source Claude Code is using. A corporate HTTP proxy is configured separately with HTTPS_PROXY.

Is there a free proxy for Claude Code?

Yes. Bifrost is open source and self-hostable at no license cost through its gateway setup guide, and Anthropic’s Claude apps gateway ships inside the claude binary. MLflow AI Gateway is also open source. You still pay the provider for tokens and operate the gateway, including keeping it current as Claude Code adds headers.

Can Claude Code use models other than Claude through a gateway?

Gateways such as Bifrost can route Claude Code requests to non-Claude models, provided the model supports the tool calling Claude Code uses for file edits and shell commands. Anthropic does not support running Claude Code against non-Claude models through any gateway, so Claude-specific server-side tools such as web search may be unavailable.

How do I set per-developer budgets for Claude Code?

Issue each developer their own gateway credential and attach a budget to it. In Bifrost, each developer gets a virtual key with a spend limit and reset period, checked alongside team budgets on every request. Claude apps gateway sets daily, weekly, or monthly caps per user or IdP group through its admin API.

Does Claude Code work with Amazon Bedrock through a gateway?

Yes. A gateway can expose the Anthropic Messages format and forward to Bedrock, which keeps developer configuration unchanged if you later switch clouds. Alternatively, developers set CLAUDE_CODE_USE_BEDROCK=1 with ANTHROPIC_BEDROCK_BASE_URL pointing at a gateway that speaks the Bedrock format. In Bifrost, a Bedrock model is pinned with a bedrock/ prefix.

Try Bifrost as Your Claude Code Gateway

A Claude Code gateway earns its place when it keeps provider credentials, per-developer budgets, audit records, and MCP tool access inside infrastructure you control. The open-source Bifrost gateway does that for Claude Code with virtual keys, CEL routing rules, request logs, and one governed MCP endpoint, deployed in your VPC or on-premises through Bifrost Enterprise.

Our survey of open-source Claude Code gateways and the enterprise guide to Claude Code on Bifrost cover more detail.