> ## Documentation Index
> Fetch the complete documentation index at: https://claude.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Limits for federated cloud access
> Counts, lengths, lifetimes, and unsupported configurations for Claude Tag's federated cloud access: gateways, AWS roles, Google Cloud identities, and authorization servers.
export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.;
This page collects the fixed limits of Federated cloud access in one place.
## Where federated connections work
Federated connections are available to Claude in Slack channels, where it acts under your organization's [agent identity](/docs/claude-tag/concepts/agent-identity). They aren't available in direct messages, which run on the individual's own claude.ai account, and they need an Anthropic-hosted environment; Claude can't use them in a [self-hosted environment](/docs/claude-tag/concepts/security-and-data).
## Identity token
| Limit | Value |
| :---------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Token lifetime | 10 minutes. Tokens can't be revoked before they expire. When you remove a gateway, Claude stops using it at once; when you remove a cloud role or authorization server, within about a minute (current behavior, may change). A token issued before the removal stays valid until it expires. |
| Signing algorithm | ES256 only. |
| Claims | See the [identity token reference](/docs/claude-tag/admins/federated-access/token-reference#claims); verifiers must ignore claims they don't recognize. |
## Gateways
| Limit | Value |
| :------------------------------------------------------------------------------------------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Registered addresses per organization | 5, counting gateways and authorization-server token endpoints together. |
| Token reuse | Claude reuses one token for a session's requests to the same gateway for about five minutes, half the token's lifetime, or until the gateway answers 401, and then requests a new one (current behavior, may change). A gateway sees the same `jti` on many requests. |
| Gateway address | An HTTPS host name only, with no path, port, query, or trailing slash. The host name needs a domain, like `gateway.example.com`, uses only letters, numbers, hyphens, and dots, and has at most 253 characters (current behavior, may change). The console rejects an IP address, a private-network name, an Anthropic-owned host, or a host cloud providers use for token exchange, and names the reason. The connection check also refuses a host name that resolves to a private address. |
| One connection per gateway | A gateway connected in one Access bundle can't be connected again in another. Attach that bundle to each scope that needs the gateway. |
| [Allowed websites](/docs/claude-tag/admins/add-connections#set-allowed-websites) on the gateway's connection | Exactly the gateway's host, the only host Claude sends the token to. It can't be widened or given a wildcard. |
| Connection check | Runs only against an HTTPS host with no path. The console sends two `POST` requests to the address, each with an empty body and a test token, doesn't follow redirects, and can take up to a minute. [Connect a gateway](/docs/claude-tag/admins/federated-access/connect-a-gateway) lists the expected responses. The console refuses a check that runs many times in quick succession and says how long to wait. |
| Same address twice in one organization | Entering an address that is already registered runs the connection check again (unless you skip it) without changing the stored result, then moves to the bundle step. The run counts toward the check limit. |
## AWS roles
| Limit | Value |
| :---------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Role ARN** | A commercial-partition IAM role, `arn:aws:iam:::role/`. AWS GovCloud and AWS China roles aren't supported. |
| **Allowed AWS hosts** | Hosts ending in `.amazonaws.com` only, for example `s3.us-east-1.amazonaws.com` or `*.amazonaws.com`. |
| Role session | 1 hour. The exchange doesn't ask for a longer session, so raising the role's maximum session duration has no effect. Claude reuses one session's credentials for the same agent until shortly before they expire, or until AWS answers a request with 403 (current behavior, may change). |
| Token audience | `sts.amazonaws.com`, the same for every organization. Condition the trust policy on the `sub` claim as well as the audience; see [Authorize on the subject](/docs/claude-tag/admins/federated-access/token-reference#authorize-on-the-subject). |
| One connection per role | A role can be connected once in your organization. |
## Google Cloud identities
| Limit | Value |
| :------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Workload identity provider** | The full resource name of a provider in a workload identity pool under a numeric project, `//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/`. Workforce identity pools aren't supported. |
| **Service account to act as** | Optional. A service account, `@.iam.gserviceaccount.com`. Default compute and App Engine service accounts aren't accepted. Leave it empty to call Google Cloud as the federated identity itself. |
| **Allowed Google hosts** | `googleapis.com`, a subdomain of it, or a subdomain of `clients6.google.com`. |
| OAuth scope | `https://www.googleapis.com/auth/cloud-platform`, always. Effective permissions come from IAM. |
| **Block requests that mint new credentials** | On by default. When on, requests to Google's credential-minting and credential-delivering endpoints are refused, including over gRPC; see [What the credential-minting block refuses](#what-the-credential-minting-block-refuses). The block is best effort and doesn't replace least-privilege IAM. |
| Google Cloud connections in one bundle | No two Google Cloud connections in the same Access bundle can cover the same host under **Allowed hosts**, whatever their providers or service accounts. A wildcard such as `*.googleapis.com` covers every subdomain but not `googleapis.com` itself. The same provider can be connected again with different hosts, or in another bundle. |
### What the credential-minting block refuses
With **Block requests that mint new credentials** on, Agent Proxy refuses these requests before they reach Google, whatever IAM would allow (current behavior, may change):
* Every request to these services, whether the service is named in the host or in the path: Security Token Service, IAM, IAM Service Account Credentials, API Keys, Firebase Authentication (Identity Toolkit and Secure Token), Cloud Workstations, Cloud SQL Admin, AlloyDB, Connect Gateway, GKE Hub, Certificate Authority Service, Identity-Aware Proxy, Apigee, Secret Manager, Parameter Manager, OS Login, Cloud Shell, Cloud Identity, the Google Workspace Admin SDK, Cloud KMS, Cloud Tasks, Cloud Scheduler, Eventarc, Workflows and Workflow Executions, API Gateway, Application Integration, Deployment Manager, Cloud Build, Cloud Composer, Dataform, AI Platform Training and Prediction, Google Kubernetes Engine, Dataproc, OS Config, Dialogflow, Storage Transfer Service, BigQuery Data Transfer Service, and Vertex AI Workbench.
* On every other Google service, methods whose response carries a credential or signature, matched by method name. For example `generate`, `refresh`, or `exchange` methods ending in `Token`, `Cert`, `Certificate`, `Credential`, `Credentials`, `Url`, `Secret`, `Password`, or `Key`, and `exchangeAppAttestAssertion` and `exchangeAppAttestAttestation` (Bigtable's `generateConsistencyToken`, which returns no credential, passes).
* Signing methods: `sign`, `signJwt`, `signBlob`, `signSshPublicKey`, and their `asymmetric`, `mac`, and `raw` forms.
* `show`, `reset`, or `retrieve` methods ending in `Credential`, `Credentials`, `Password`, `Secret`, or `SecretKey`, plus `add` or `import` methods ending in `PublicKey`, and methods starting with `signUp` or `signIn`.
* `setIamPolicy` on any resource, and Compute Engine `setMetadata`, `setCommonInstanceMetadata`, `updatePerInstanceConfigs`, `patchPerInstanceConfigs`, instance updates, and instance settings writes.
* Cloud Storage IAM and ACL writes, and HMAC key creation.
* IAM service account key creation and upload; API Keys `keyString` and Memorystore `authString` reads.
* Pub/Sub subscription creation, update, and `modifyPushConfig`, and Cloud Monitoring uptime check creation and changes.
* Google's OAuth 2.0 token endpoint (`oauth2.googleapis.com/token`), HTTP batch requests (a path that starts with `/batch`), and any request framed as gRPC, gRPC-Web, or `$rpc`.
On services not listed above, reads such as `getIamPolicy`, `testIamPermissions`, and `tokeninfo` pass. If Claude needs one of the refused services, clear the checkbox on that connection and rely on IAM alone.
## Authorization servers
| Limit | Value |
| :-------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Token endpoint** | A full HTTPS URL of at most 256 characters (current behavior, may change), with an optional path and no port, query, fragment, user name, password, spaces, or special characters. The same host rules as a gateway address apply, and a trailing slash is dropped. |
| Token audience | Your authorization server's issuer identifier as you entered it (an HTTPS URL on the same host as the token endpoint, with the same address rules), or the token endpoint URL exactly when you left the issuer identifier empty. It can't be changed after the server is connected. |
| **Resource** | Optional. An absolute URI with no fragment, at most 256 characters with no spaces (current behavior, may change). |
| **Scope** | Optional. Space-separated scope words with no quotes or backslashes, at most 256 characters in total (current behavior, may change). |
| **Allowed API hosts** | Must not include the token endpoint's host. |
| Token exchange | A form-encoded `POST` that doesn't follow redirects and must complete within about 10 seconds (current behavior, may change). |
| Access token reuse | Reused until about five minutes before it expires (for tokens shorter than 10 minutes, until half their lifetime has passed) when `expires_in` is between 5 minutes and 1 day. When `expires_in` is missing or shorter, the token is used for one request. When it is longer than a day, the token isn't cached either, so every request goes to the token endpoint. (Current behavior, may change.) |
| Subject check | Your authorization server performs it; the console has no connection check for token endpoints. The server must accept only your own agents' full subjects, or at minimum check that each token's subject starts with your organization's **Subject prefix**. |
| Endpoint reuse | A registered address can be connected as a gateway or as an authorization server, not both. A token endpoint stays listed in the **Gateways** table after you remove its authorization server, and frees its place among the 5 registered addresses only when you remove it there too. |
## Testing
The console's connection check is the only way to have Anthropic send a token to your gateway before Claude does. There is no way to request a test token for your own use. To test end to end, follow the Verify step on each connection page.
## Related resources
* [Identity token reference](/docs/claude-tag/admins/federated-access/token-reference): claims, issuer, keys, and rotation
* [Connect a gateway](/docs/claude-tag/admins/federated-access/connect-a-gateway)
* [Connect an AWS role](/docs/claude-tag/admins/federated-access/aws)
* [Connect a Google Cloud identity](/docs/claude-tag/admins/federated-access/gcp)
* [Connect an authorization server](/docs/claude-tag/admins/federated-access/authorization-server)
* [Network requirements](/docs/claude-tag/admins/network-requirements): Anthropic's egress range and internet reachability