Which Claude Code gateway does a team need?

Claude Code sends its API traffic to whatever address ANTHROPIC_BASE_URL holds. A gateway is a server at that address that forwards each request to a provider.

Two credentials are involved. Each developer holds one issued by the gateway, which identifies them in usage tracking. The gateway holds one for the provider account, shared by all forwarded traffic.

That gives one place for credentials, usage per developer, budgets and audit logs. The provider key stays on the server, never on a laptop.

When inference has to run through your own cloud account. It forwards to Amazon Bedrock, Claude Platform on AWS, Google Cloud, Microsoft Foundry or the Anthropic API.

It ships in the claude binary and is built and tested with each Claude Code release, so it forwards the beta headers and request fields Claude Code sends. It charges no licence or per-seat fee; you pay for inference and the compute it runs on.

Developers sign in with your identity provider. Model access and managed settings are set per identity-provider group, and usage goes out as OpenTelemetry metrics to a collector you run.

It has limits. It serves Claude Code and Claude Desktop, not Codex. Its sign-in is a browser step with no service-token flow, so a CI job calls the provider directly. Claude Code connects to it only on a private address, so a developer away from the office needs the VPN. The detail is in Selan and the Claude apps gateway.

When you already run one for your own product and want Claude Code in the same place. These gateways reach far more providers: LiteLLM over 100, Bifrost over 20, and Portkey more than 1,600 models.

Each developer then holds a key from that gateway, such as a LiteLLM or Bifrost virtual key or a Portkey API key, in their settings file. You issue, cap and revoke those keys yourself.

Anthropic's docs name the trade-off: the gateway becomes infrastructure you operate. Claude Code adds capabilities with each release, and a gateway that does not forward them breaks those features. Anthropic does not endorse or audit other gateways, and does not support routing Claude Code to non-Claude models through any gateway.

Each is compared fairly in Selan and LiteLLM, Selan and Bifrost and Selan and Portkey. If your company already runs Kong for its APIs, Kong AI Gateway adds Claude Code to it with an identity-provider sign-in, as Selan and Kong AI Gateway shows. If your team already traces its AI apps in MLflow, its gateway records every Claude Code request on each developer's own Anthropic login, as Selan and MLflow AI Gateway shows.

When one developer wants to try other models from their own machine. Claude Code Router is free under the MIT licence and listens on http://127.0.0.1:3456.

The provider keys are entered into it and stored on that machine, and its logs cover that install only. Run with Docker on a server, it can serve more people, and someone then runs that server. It is compared in Selan and Claude Code Router.

Not their own. While a gateway credential or apiKeyHelper is active, Claude Code sends that credential in place of the developer's claude.ai login. The subscription's usage limits do not apply to those requests.

The traffic is billed to whoever owns the credential the gateway forwards with. That can be your Anthropic Console account, or your Bedrock, Google Cloud or Foundry account.

Setting only ANTHROPIC_BASE_URL, with no gateway credential, is the exception. Requests still pass through the gateway, but the saved claude.ai login stays the active credential, so its limits and billing apply.

When nobody wants to run a gateway. Selan is built and hosted in the EU, with no server, database or private network to set up. A developer runs selan login once with Google or Microsoft, then selan claude or selan codex, from any network.

No provider key reaches a laptop. Selan runs on the Claude and ChatGPT accounts and API keys your company connects; which cover which models is in Models and providers.

Claude Code, Codex, OpenCode and Claude Desktop go through the same gateway, into one usage record per person. An owner can set a spend limit per person, by day, week or month in UTC, on pay-per-use keys; limits are on the spend page.

A CI job gets a token an owner mints, carried as SELAN_TOKEN; the setup is in Running unattended. Your own apps use the same gateway at https://gw.selan.ai/anthropic, as the API docs show.

Cloudflare AI Gateway is a hosted kind reached by a gateway token instead of a sign-in. It is compared in Selan and Cloudflare AI Gateway.

Free for up to three seats, and the Free plan needs no card.