Limits for federated agent access

This page collects the fixed limits of Federated agent access in one place.

Where federated connections work

Federated connections are available to Claude in Slack channels, where it acts under your organization’s agent identity. They aren’t available in one-to-one direct messages, which run on the individual’s own claude.ai account, and they need an Anthropic-hosted environment; Claude can’t use them in a self-hosted environment.

Identity token

Limit	Value
Token lifetime	10 minutes. Tokens can’t be revoked before they expire. When you remove a gateway, Claude stops using it at once; when you remove a cloud role or authorization server, within about a minute (current behavior, may change). A token issued before the removal stays valid until it expires.
Signing algorithm	ES256 only.
Claims	See the identity token reference; verifiers must ignore claims they don’t recognize.

Gateways

Limit	Value
Registered addresses per organization	5, counting gateways and authorization-server audience addresses together.
Token reuse	Claude reuses one token for a session’s requests to the same gateway for about five minutes, half the token’s lifetime, or until the gateway answers 401, and then requests a new one (current behavior, may change). A gateway sees the same `jti` on many requests.
Gateway address	An HTTPS host name only, with no path, port, query, or trailing slash. The host name needs a domain, like `gateway.example.com`, uses only letters, numbers, hyphens, and dots, and has at most 253 characters (current behavior, may change). The console rejects an IP address, a private-network name, an Anthropic-owned host, or a host cloud providers use for token exchange, and names the reason. The connection check also refuses a host name that resolves to a private address.
Allowed websites on the gateway’s connection	Exactly the gateway’s host, the only host Claude sends the token to. It can’t be widened or given a wildcard.
Connection check	Runs only against an HTTPS host with no path. The console sends two `POST` requests to the address, each with an empty body and a test token, doesn’t follow redirects, and can take up to a minute. Connect a gateway lists the expected responses. The console refuses a check that runs many times in quick succession and says how long to wait.
Same address twice in one organization	Entering an address that is already registered runs the connection check again (unless you skip it) without changing the stored result, then moves to the bundle step. The run counts toward the check limit.

AWS roles

Limit	Value
Role ARN	A commercial-partition IAM role, `arn:aws:iam::<account>:role/<name>`. AWS GovCloud and AWS China roles aren’t supported.
Allowed AWS hosts	Hosts ending in `.amazonaws.com` only, for example `s3.us-east-1.amazonaws.com` or `*.amazonaws.com`.
Role session	1 hour. The exchange doesn’t ask for a longer session, so raising the role’s maximum session duration has no effect. Claude reuses one session’s credentials for the same agent until shortly before they expire, or until AWS answers a request with 403 (current behavior, may change).
Token audience	`sts.amazonaws.com`, the same for every organization. Condition the trust policy on the `sub` claim as well as the audience; see Authorize on the subject.
One connection per role	A role can be connected once in your organization.

Google Cloud identities

Limit	Value
Workload identity provider	The full resource name of a provider in a workload identity pool under a numeric project, `//iam.googleapis.com/projects/<number>/locations/global/workloadIdentityPools/<pool>/providers/<provider>`. Workforce identity pools aren’t supported.
Service account to act as	Optional. A service account, `<name>@<project>.iam.gserviceaccount.com`. Default compute and App Engine service accounts aren’t accepted. Leave it empty to call Google Cloud as the federated identity itself.
Allowed Google hosts	`googleapis.com`, a subdomain of it, or a subdomain of `clients6.google.com`.
OAuth scope	`https://www.googleapis.com/auth/cloud-platform`, always, with no setting to change it. On Google Cloud APIs, IAM decides what the credential can do. An API that needs an OAuth scope of its own answers 403 whatever IAM allows; see The cloud API answers 403 after a successful exchange.
Block requests that mint new credentials	On by default. When on, requests to Google’s credential-minting and credential-delivering endpoints are refused, including over gRPC; see What the credential-minting block refuses. The block is best effort and doesn’t replace least-privilege IAM.
Google Cloud connections in one bundle	No two Google Cloud connections in the same bundle can cover the same host under Allowed hosts, whatever their providers or service accounts. A wildcard such as `*.googleapis.com` covers every subdomain but not `googleapis.com` itself. The same provider can be connected again with different hosts, or in another bundle.

What the credential-minting block refuses

With Block requests that mint new credentials on, Agent Proxy refuses these requests before they reach Google, whatever IAM would allow (current behavior, may change):

Every request to these services, whether the service is named in the host or in the path: Security Token Service, IAM, IAM Service Account Credentials, API Keys, Firebase Authentication (Identity Toolkit and Secure Token), Cloud Workstations, Cloud SQL Admin, AlloyDB, Connect Gateway, GKE Hub, Certificate Authority Service, Identity-Aware Proxy, Apigee, Secret Manager, Parameter Manager, OS Login, Cloud Shell, Cloud Identity, the Google Workspace Admin SDK, Cloud KMS, Cloud Tasks, Cloud Scheduler, Eventarc, Workflows and Workflow Executions, API Gateway, Application Integration, Deployment Manager, Cloud Build, Cloud Composer, Dataform, AI Platform Training and Prediction, Google Kubernetes Engine, Dataproc, OS Config, Dialogflow, Storage Transfer Service, BigQuery Data Transfer Service, and Vertex AI Workbench.
On every other Google service, methods whose response carries a credential or signature, matched by method name. For example generate, refresh, or exchange methods ending in Token, Cert, Certificate, Credential, Credentials, Url, Secret, Password, or Key, and exchangeAppAttestAssertion and exchangeAppAttestAttestation (Bigtable’s generateConsistencyToken, which returns no credential, passes).
Signing methods: sign, signJwt, signBlob, signSshPublicKey, and their asymmetric, mac, and raw forms.
show, reset, or retrieve methods ending in Credential, Credentials, Password, Secret, or SecretKey, plus add or import methods ending in PublicKey, and methods starting with signUp or signIn.
setIamPolicy on any resource, and Compute Engine setMetadata, setCommonInstanceMetadata, updatePerInstanceConfigs, patchPerInstanceConfigs, instance updates, and instance settings writes.
Cloud Storage IAM and ACL writes, and HMAC key creation.
IAM service account key creation and upload; API Keys keyString and Memorystore authString reads.
Pub/Sub subscription creation, update, and modifyPushConfig, and Cloud Monitoring uptime check creation and changes.
Google’s OAuth 2.0 token endpoint (oauth2.googleapis.com/token), HTTP batch requests (a path that starts with /batch), and any request framed as gRPC, gRPC-Web, or $rpc.

On services not listed above, reads such as getIamPolicy, testIamPermissions, and tokeninfo pass. If Claude needs one of the refused services, clear the checkbox on that connection and rely on IAM alone.

Authorization servers

Limit	Value
Token endpoint	A full HTTPS URL of at most 256 characters (current behavior, may change), with an optional path and no port, query, fragment, user name, password, spaces, or special characters. The same host rules as a gateway address apply, and a trailing slash is dropped.
Token audience	Your authorization server’s issuer identifier as you entered it (an HTTPS URL on the same host as the token endpoint, with the same address rules), or the token endpoint URL exactly when you left the issuer identifier empty. It can’t be changed after the server is connected.
Resource	Optional. An absolute URI with no fragment, at most 256 characters with no spaces (current behavior, may change).
Scope	Optional. Space-separated scope words with no quotes or backslashes, at most 256 characters in total (current behavior, may change).
Allowed API hosts	Can include the token endpoint’s host only when the endpoint’s address has a folder of its own, like `/oauth2` in `https://auth.example.com/oauth2/token`, and you list Allowed API paths.
Allowed API paths	Needed only when an allowed host covers the token endpoint’s host. 1 to 32 paths, each starting with `/`, not ending with `/`, at most 256 characters, and not overlapping the token endpoint’s folder. A path can’t contain spaces, non-English letters, `..`, `//`, a part ending with a dot, or any of `%`, `?`, `#`, `;`, `@`, `+`, or a backslash (current behavior, may change).
Token exchange	A form-encoded `POST` that doesn’t follow redirects and must complete within about 10 seconds (current behavior, may change).
Access token reuse	Reused until about five minutes before it expires (for tokens shorter than 10 minutes, until half their lifetime has passed) when `expires_in` is between 5 minutes and 1 day. When `expires_in` is missing or shorter, the token is used for one request. When it is longer than a day, the token isn’t cached either, so every request goes to the token endpoint. (Current behavior, may change.)
Subject check	Your authorization server performs it; the console has no connection check for token endpoints. The server must accept only your own agents’ full subjects, or at minimum check that each token’s subject starts with your organization’s Subject prefix.
Endpoint reuse	A registered address can be connected as a gateway or as an authorization server, not both. An authorization server’s audience address stays listed in the Gateways table after you remove the server, and frees its place among the 5 registered addresses only when you remove it there too.

Testing

The console’s connection check is the only way to have Anthropic send a token to your gateway before Claude does. There is no way to request a test token for your own use. To test end to end, follow the Verify step on each connection page.

Identity token reference: claims, issuer, keys, and rotation
Connect a gateway
Connect an AWS role
Connect a Google Cloud identity
Connect an authorization server
Network requirements: Anthropic’s egress range and internet reachability

How it works

For administrators

For end users

Use case library

Where federated connections work

Identity token

Gateways

AWS roles

Google Cloud identities

What the credential-minting block refuses

Authorization servers

Testing

​Where federated connections work

​Identity token

​Gateways

​AWS roles

​Google Cloud identities

​What the credential-minting block refuses

​Authorization servers

​Testing

​Related resources

Where federated connections work

Identity token

Gateways

AWS roles

Google Cloud identities

What the credential-minting block refuses

Authorization servers

Testing

Related resources