These keys point Claude Desktop at a bootstrap server that returns the rest of the configuration per user at sign-in. When a bootstrap response is in effect, it replaces every bootstrap-settable key below; the values in this profile are not consulted.

Connection

Activation

Provider credentials

Each provider has its own required keys, documented on its dedicated page below. Keys for providers other than the one selected in inferenceProvider are ignored.

<Card title="Amazon Bedrock" href="/cowork/3p/bedrock">
  `inferenceProvider: "bedrock"`
</Card>

<Card title="Amazon Bedrock Mantle" href="/cowork/3p/mantle">
  `inferenceProvider: "mantle"`
</Card>

<Card title="Microsoft Foundry" href="/cowork/3p/foundry">
  `inferenceProvider: "foundry"`
</Card>

<Card title="LLM gateway" href="/cowork/3p/gateway">
  `inferenceProvider: "gateway"`
</Card>

In the in-app configuration window, each provider's credentials card has a Test connection button that makes a minimal inference request with the values you've entered, and a Test model discovery button that calls the provider's model-list endpoint. Use them to validate credentials and reachability before exporting.

Anthropic API

When inferenceProvider is anthropic, inference goes directly to the Anthropic API. This option does not offer third-party data residency; see the overview for what that means for the compliance statements on these pages.

Credential helper

For environments where static API keys aren't permitted, Cowork on 3P can invoke an executable you provide to fetch a short-lived credential at runtime.

The helper runs on the host (outside the sandbox) and applies to all providers, including Google Cloud's Vertex AI. For Vertex the helper's token is sent as the bearer on each request; combine with inferenceCustomHeaders or return headers from the helper JSON if your deployment requires additional per-request headers. Pair the helper with your organization's SSO, secrets manager, or PKI tooling.

The script may print either a bare credential string, or a JSON object of the form {"token": "...", "headers": {"X-Name": "Value", ...}}. When JSON is returned, token is used as the credential and each entry in headers is sent as a custom HTTP header on every inference request. These headers are merged with inferenceCustomHeaders; on a name conflict, the helper's value wins.

The app sets the CLAUDE_HELPER_CONTEXT environment variable on every invocation so the script can tell a user-initiated session start from a mid-session refresh or a background health check. See Write a credential helper for the full stdout contract, the context values, and timeout behavior.

Credential expiry and refresh

The app checks the active credential's expiry before each turn and refreshes it silently when possible — re-running the helper (unless inferenceCredentialHelperSilentRefreshEnabled is false), or using the stored refresh token for interactive sign-in kinds. If the provider returns HTTP 401 mid-turn, the app attempts the same silent refresh before surfacing an error. When silent refresh fails, a prompt appears with a provider-specific action — a re-sign-in button for interactive sign-in kinds, or an admin-contact message for static credentials. This applies to all providers, including Vertex AI and Bedrock IAM Identity Center sign-in, and to both the Cowork and Code tabs.

In the in-app configuration window, the Helper script card has a Test script button that executes the script once and shows a status chip with the exit code, the run time, and whether stdout produced a non-empty credential. Use it to validate the script before exporting the configuration.

Models

Offering a 1M-token context variant

If your provider serves a model with the extended 1M-token context window, you can expose it as a separate picker entry by setting supports1m: true on that model's entry:

"inferenceModels": [
  { "name": "claude-opus-4", "supports1m": true },
  "claude-sonnet-4"
]

supports1m is a capability assertion you make about your deployment — Cowork doesn't probe the provider to verify it. Only set it for models you've confirmed support the extended window; selecting a 1M variant on a model that doesn't will fail mid-session once the conversation grows past the model's actual limit.

[!NOTE] Gateway: the name must be the exact ID your gateway's /v1/models endpoint returns. If you set supports1m on an alias (sonnet) but discovery returns the full ID (claude-sonnet-4-6), the variant won't appear.

Setting a display label

By default, Cowork derives a friendly picker label from the model ID. For IDs where that derivation falls through (Bedrock application-inference-profile ARNs, provisioned-throughput ARNs, or gateway routing aliases), set labelOverride to the text you want shown in the model picker:

"inferenceModels": [
  {
    "name": "arn:aws:bedrock:us-east-1:123456789012:application-inference-profile/abc123",
    "labelOverride": "Claude Opus (Prod)"
  },
  { "name": "us.anthropic.claude-sonnet-4-20250514-v1:0" }
]

labelOverride is display-only; the name value is still what Cowork sends to the provider.

Mapping a model to a Claude tier

The Code tab and some Cowork features refer to models by tier alias — haiku, sonnet, opus, fable, mythos — rather than by full ID. When your provider uses its own model IDs (for example Bedrock inference-profile IDs or gateway routing aliases), set anthropicFamilyTier on each entry so the app knows which Claude tier that ID stands in for:

"inferenceModels": [
  { "name": "us.anthropic.claude-opus-4-20250514-v1:0", "anthropicFamilyTier": "opus" },
  { "name": "us.anthropic.claude-sonnet-4-20250514-v1:0", "anthropicFamilyTier": "sonnet" }
]

This controls which of your configured models is used when the app asks for a bare tier alias, and which model the Code tab falls back to when a higher tier refuses a request. An unknown value is silently dropped; the entry is kept. When more than one entry shares the same tier (for example a standard and a 1M-context variant), set isFamilyDefault: true on the one that should win; otherwise the first matching entry is used.

Workspace restrictions

[!NOTE] coworkEgressAllowedHosts applies to both the Cowork and Code tabs. In the Cowork tab it governs the sandbox's web fetch, shell commands, and package installs. In the Code tab it is translated into Claude Code's network sandbox allowlist; if you have also deployed a separate Claude Code managed-settings file on the endpoint, that policy takes precedence by default — see Interaction with Claude Code's own managed settings.

It does **not** apply to [Web Search](/cowork/3p/web-tools#web-search), which runs server-side at your inference provider rather than from the sandbox.

Beta features

Features shown with a Beta badge in the Setup UI are pre-GA capabilities that may change before general availability. The badge is informational only; whether a beta feature is available is controlled by its own key.

Auto mode

When autoModeEnabled is true, users can select Act without asking in the Cowork tab and Auto mode in the Code tab. In this mode, Claude runs a safety classifier on each action and only prompts for approval on actions it judges risky, instead of following the static per-tool policy.

Auto mode requires a model that supports the classifier; on older models the option is shown greyed out. builtinToolPolicy and autoModeEnabled may both be set — Auto mode is a user-selectable option alongside the default policy, not a replacement for it.

In the Code tab, a separately deployed Claude Code managed-settings file that sets disableAutoMode to "disable" overrides this key and keeps Auto mode hidden.

Connectors & extensions

See MCP, plugins, skills, and hooks for the org-plugins directory layout and the full managedMcpServers schema.

managedMcpServers

A JSON-stringified array of server objects:

When the MCP server's OAuth provider doesn't support dynamic client registration (for example, Slack or Microsoft Entra ID), set oauth to an object describing a client you've registered with that provider:

The app builds the redirect URI as http://<callbackHost>:<callbackPort>/callback; register that exact value with the OAuth provider. OAuth-authenticated connectors refresh their access token automatically during a session, so users are not interrupted when the initial token expires.

toolPolicy

Each value controls what users see when Claude calls that tool:

In the Code tab, blocked and ask are enforced as Claude Code permission rules (see Applied as managed policy); allow is not forwarded there. The tool follows Claude Code's normal prompting, the same as a tool that isn't listed.

orgPluginSettings

A JSON-stringified object that applies toolPolicy locks to MCP servers delivered through the org-plugins directory, keyed by server name:

{
  "mcpServers": {
    "internal-search": { "toolPolicy": { "delete_document": "blocked" } }
  }
}

If a managedMcpServers entry and an org-plugin server share a name, the managedMcpServers entry wins and its toolPolicy (if any) applies; the orgPluginSettings entry for that name is ignored.

Telemetry & updates

See Telemetry and egress for what each category sends and the network paths involved.

Anthropic telemetry and updates

[!NOTE] Generate and set deploymentOrganizationUuid before rollout. Anthropic uses this value to locate crash reports and telemetry from your fleet when you open a support case. If it's unset, your telemetry is tagged with a shared placeholder UUID (00000000-0000-4000-8000-000000000001) that every unconfigured deployment also uses, and Anthropic cannot distinguish your organization's events from anyone else's.

OpenTelemetry export

Export full session activity to your own collector. See Monitoring for the event schema.

Usage limits

Appearance

banner

A JSON-stringified object: