Repository navigation
docs: Edge Gateway section (setup, access, connection details, Multipass, Claude Code, inference API keys) - #603
sathyasaravanamuthu wants to merge 21 commits into
Conversation
…ultipass New how-to page covering the C1 Multipass loopback inference and egress endpoints: turning on routing, installing the CLI, connecting a shell, OpenAI-compatible inference, HTTPS egress with CA trust, MDM distribution, troubleshooting, and FAQ. Marked early access. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Preview deployment for your docs. Learn more about Mintlify Previews.
|
…er Linux Move the page to product/admin/connect-edge-gateway-multipass and list it under a new Gateway group with a "Connect to Edge via Multipass" section. Make it platform-generic: macOS desktop app and Linux headless service tabs, per-platform CA bundle and trust-store steps, and a note that Windows is not supported yet. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add a redacted C1 Multipass Settings screenshot showing the command line tool install and routing status, a setup-at-a-glance summary, a clearer section on loading the endpoint credentials, and a "List models and run inference" section with response shape, chat completions, and OpenAI SDK examples. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sibling page under Gateway > Connect to Edge via Multipass: configure Claude Code's apiKeyHelper to use `c1-multipass inference helper` for short-lived Edge Gateway inference tokens, with a separate settings file, a test command, an optional alias, Edge pinning, token handling, and troubleshooting. Link it from the local inference endpoint note. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Explain when to use a C1 inference API key versus the C1 Multipass options, how to create one in AI & API > Inference API keys, test it with curl (models, Anthropic Messages, OpenAI Responses and Chat Completions), and use it with Claude Code, OpenAI SDKs, and the Anthropic SDK. Covers revocation and rotation, status-code troubleshooting, and FAQ. Includes a redacted screenshot of the create dialog. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…on details) Add the admin side of the Gateway section for inference: an overview of how an Edge Gateway serves models, setting up an Edge (add, runtime identity, providers and keys, routes, Bearer tokens, turn on), granting List models / Call models, and finding connection details and connect methods. Link the existing client pages' prerequisites to the new admin pages. Screenshots are from a dev tenant with hostnames redacted. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Document tool-first connections, short-lived helpers, Codex profiles, and current model setup. Clarify long-lived API key policy and stage-aware troubleshooting. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Update five setup captures and their descriptions, restore the long-lived API key setting image, and make Cross-App Access a client prerequisite. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Guide an admin and developer through one model route, access grants, Claude Code setup, and an Activity check. Place the quickstart immediately after the overview. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Add current Claude Code and Codex connection captures, clarify quickstart proxy and platform requirements, and explain where to enable Cross-App Access. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Add provider examples, failover and tier guidance, and a dedicated Codex guide. Group client documentation by use case and centralize Multipass setup. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Keep Anthropic as the worked example and point to OpenAI, Gemini Developer API, Together, Fireworks, and Bedrock guidance with matching API formats. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Keep the API-key prerequisite and provider examples focused on the quickstart path. Leave advanced routing and setup references unchanged. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
| <Step title="Publish one model"> | ||
| Open **Inference** > **Add models** and select your provider: **Anthropic** in this example. Choose a vault and API-key secret, or use **Create vault and secret** to store your provider key. Confirm the runtime identity can read the key. | ||
|
|
||
| Under **Models**, type the full provider model ID and select the offered option. Registered-model suggestions depend on your organization's rollout channel; provider catalog suggestions can also appear. If your model isn't suggested, type its ID. Click **Publish**, then note the **Route ID** in the routes table for the developer's configuration. |
There was a problem hiding this comment.
Could we include a concrete, full model-ID example here? This is an Anthropic + Claude Code quickstart, and “full provider model ID” leaves a first-time admin unsure whether to type a display name, a shorthand such as sonnet-5-5, or an API identifier.
Anthropic's current model reference lists claude-sonnet-5-5 and claude-opus-5-5 as Claude API IDs (https://platform.claude.com/docs/en/models/overview). For the Anthropic provider, the ID must include the claude- prefix; IDs from other provider platforms can differ.
Suggested wording:
Under Models, enter the full Anthropic API model ID—for example,
claude-sonnet-5-5—and select the offered option. Use a model your Anthropic API key can access; the example is illustrative, and a model appearing in suggestions does not establish provider access. If the model is not suggested, paste its exact ID from Anthropic's model reference. Click Publish, then copy the Route ID from the routes table for the developer's configuration.
One worked example is enough here; other providers' ID formats can remain in the routing reference. Please carry the chosen Route ID through the later client configuration so the admin can follow the example end to end.
| - Edge Gateway is enabled for your tenant. | ||
| - You have a model provider API key, or an AWS account for Bedrock. | ||
| - You know which application should own the Edge. Its List models and Call models entitlements live on that app. | ||
| - Make sure **Cross-App Access** is on under **Settings** > **Cross-App Access** so C1 can issue Edge tokens. The Edge's **Overview** warns if it's off. If the setting isn't available, contact the C1 Support team. See [Enable enterprise-managed authorization](/product/admin/enterprise-managed-authorization/enable). |
There was a problem hiding this comment.
Please update the navigation path from Settings > Cross-App Access to AI > Cross-App Access. In the current UI, users open AI in the left navigation, then select Cross-App Access under the AI Gateway heading.
Suggested wording: “Open AI > Cross-App Access and make sure Cross-App Access is enabled so C1 can issue Edge tokens.”
Please apply this correction to the other new Edge Gateway pages that repeat Settings > Cross-App Access. The linked existing “Enable enterprise-managed authorization” guide also uses the old Settings path and should be updated for consistency.
| Click the **Grants** tab. | ||
| </Step> | ||
| <Step> | ||
| Under **List models** or **Call models**, click **Grant access**. |
There was a problem hiding this comment.
Please update this guide and its screenshots to match the current Grants UI. The live screen now shows a capability summary row (Inference, containing both List models and Call models), access-profile/auto-membership/requestability columns, and a Members section with an Add member button. It does not show separate entitlement sections with Grant access buttons as these steps and screenshots describe.
Please walk through the current Grants > Members > Add member flow and document the actual picker and submit labels, whether/how both inference entitlements are granted together, and how to remove membership. Recheck the “Repeat for the other entitlement” instruction and the old Manual chip wording against that flow.
Also revise the automatic-access section below: explain the current access-profile / Auto membership controls and where to configure them, rather than assuming Populate with all accounts of appears under each entitlement. Clarify whether creating an access profile is optional for a direct grant or required for a particular membership path. Replace both grant screenshots and their alt text with captures of the current UI, and align the quickstart's grant-access step with the same workflow.
Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
d1ca150 to
f3f34c3
Compare
Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
400be85 to
67461f1
Compare
Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
67461f1 to
1454eb0
Compare
Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
d84fb30 to
7f2a578
Compare
Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
| | **C1 Balanced** | `c1-balanced` | | ||
| | **C1 Best** | `c1-best` | | ||
|
|
||
| In **Add models**, open **C1 recommendations** > **Choose tiers**, select an available tier, and click **Publish**. Add a key for a provider that can serve the tier before publishing. The tier displays its current model and route ID. |
There was a problem hiding this comment.
[P1] Tier publishing currently fails before the server expands the model
This workflow is blocked in the current product. With an existing Anthropic route/key and C1 Balanced assigned to a registered, successfully tested Bedrock model, selecting the tier and clicking Publish returns:
Edge.InferenceRoutes[1].Targets[0].UpstreamModelId: value length must be between 1 and 255 runes, inclusive
The tier request serializes connected provider credentials as targets without upstream model IDs, expecting the server to resolve the tier's model. However, request validation requires a nonempty upstream model ID on every target and rejects the request before tier expansion runs. Entering an AWS region does not resolve this mismatch.
Please coordinate a product fix and validate this exact path end to end before presenting the publish/follow/pin procedure as working. Include a regression case with an existing provider connection, since its credential-only target triggers this failure. If the fix won't be available when these docs ship, clearly mark the affected workflow as unavailable in the relevant release.
Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
jerenkrantz
left a comment
There was a problem hiding this comment.
Two notes from a source check of the latest revision:
- Codex server exports (inline below):
c1-multipass-fleet edge envonly prints exports for the local routes that exist, so the "includingHTTPS_PROXY" wording is inaccurate for an inference-only Edge. - C1 tier recommendations: the product fix for the tier publishing failure (credential-only targets rejected with
UpstreamModelId: value length must be between 1 and 255 runes) has merged. Once it's deployed, the publish/follow/pin workflow removed in b18fc5e can come back if you want it in this guide; worth a quick end-to-end check of publishing a tier over an existing provider connection first.
Optional clarifications for the renewal section, both consistent with the current text:
- Reusing a valid C1 ID token gets new ID-JAGs but doesn't extend the ID token itself. To get a fresh ID token, start a new authorization-code flow with
prompt=none; the user has to sign in interactively if their C1 browser session or sign-in requirements don't allow silent authorization. - The token exchange requires the application's confidential OIDC client credentials, and the ID token's audience must match that client ID; an ID token from another identity provider or client can't be exchanged.
| eval "$(c1-multipass-fleet edge env)" | ||
| ``` | ||
|
|
||
| The `eval` command executes the shell exports printed by Multipass, including `OPENAI_BASE_URL`, `OPENAI_API_KEY`, and `HTTPS_PROXY`. The API key is a local routing credential, not an upstream provider key. Avoid running `edge env` by itself, because its output includes the credential. |
There was a problem hiding this comment.
edge env exports OPENAI_BASE_URL and OPENAI_API_KEY only when the inference listener is running, and HTTPS_PROXY only when egress routing is available, so an inference-only Edge doesn't get HTTPS_PROXY.
Suggested wording:
| The `eval` command executes the shell exports printed by Multipass, including `OPENAI_BASE_URL`, `OPENAI_API_KEY`, and `HTTPS_PROXY`. The API key is a local routing credential, not an upstream provider key. Avoid running `edge env` by itself, because its output includes the credential. | |
| The `eval` command executes the shell exports Multipass prints for the available local routes: `OPENAI_BASE_URL` and `OPENAI_API_KEY` for inference, and `HTTPS_PROXY` when egress routing is available. The API key is a local routing credential, not an upstream provider key. Avoid running `edge env` by itself, because its output includes the credential. |
Summary
Add the early-access Edge Gateway documentation, organized into five admin guides and a Connect tools group:
Clarify that short-lived Multipass helper tokens are available independently of Allow long-lived API keys, explain the Cross-App Access prerequisite, and distinguish typed model IDs from catalog suggestions and actual provider access.
Validation
docs.json; verified the exact navigation order and Connect tools grouping.2aca70f2c8a81a42741a5069ec2b041d02ba05da.mint broken-links,mint dev, and local Vale weren't run. Hosted deployment and validator results are reported separately above.The client commands and provider calls have not been executed as part of these documentation checks. A successful deployment and static checks do not establish provider connectivity or runtime behavior.