Skip to main content

Enable passthrough for Claude Code

Enterprise Tier

In passthrough mode a developer keeps their own Claude Max or Pro subscription and Anthropic bills them directly, while Agent Router routes and observes the traffic. Three things have to be set up on the administrator side before that works.

Developers configure their own side separately, see Connect Claude Code. This page is what has to be true in Agent Router before that works.

What passthrough changes, and what it does not​

Passthrough changes how a request is authenticated. The developer's own Anthropic token is forwarded untouched and Agent Router adds no credential of its own.

It changes nothing about how a request is routed. The provider and the model are resolved exactly as they are for any other request, so the setup below is required whether or not the traffic is billed to the organization.

1. Enable an Anthropic provider, in the organization and on the project​

Passthrough works with Anthropic providers only, because it forwards an Anthropic token to an Anthropic API. There is no equivalent for Vertex, Bedrock, OpenAI, or a self-hosted endpoint. Those providers still route normally, using Agent Router's own credentials.

Enabling a provider for the organization does not make it usable by a project. A project has its own list of enabled providers, and the gateway serving that project only routes providers on that list. Enable Anthropic in both places: in the catalog, and on the project the developers use. Switch between them with the selector at the top right of the Console.

Only one Anthropic provider is supported. A second one under a different name will not serve Claude Code, so an organization cannot run passthrough and managed Anthropic side by side: passthrough for developers with a subscription, and a managed key for agents and API callers, is not available today.

2. Set the provider's authentication type to API key​

Choose API key and store an Anthropic key.

The authentication type does two things: it selects the credential used for managed traffic, and it tells the gateway which API format the provider speaks. Passthrough traffic uses the second, the developer's own token authenticates the request, and the gateway still needs to know it is talking to Anthropic.

3. Enable the models developers will send, and assign them to the project​

A model that is not enabled, or not assigned to the developer's project, is rejected with 400 model_not_found. This is the same check every request goes through; passthrough does not skip it.

As with providers, enabling a model in the catalog makes it available to the organization, not to a project. Both steps are needed: enable it, then assign it to the project.

Claude Code has its own built-in list of models. It does not ask Agent Router what is available, so the models it offers and the models enabled in Agent Router are two separate lists. Enable the ones the developers use.

When a developer reports that passthrough is not working, check this first. They can only pick from Claude Code's list, so a model that is not enabled fails with nothing for them to change.

Checking it works​

Ask the developer for one request through Claude Code, then open Request Logs in the Console. A passthrough request is labeled passthrough, and shows the model that served it.

If the request never arrives, the problem is the developer's configuration. If it arrives and fails, work through the three items above in order.

If an enabled model is missing from the gateway's model list, it is almost always the project step: the model, or its provider, is enabled for the organization and not assigned to the project.

If an enabled model is missing from /v1/models on the gateway, it is almost always the project step: either the model or its provider is enabled for the organization and not assigned to the project.