docs: Edge Gateway section (setup, access, connection details, Multipass, Claude Code, inference API keys)

docs.json

@@ -343,6 +343,27 @@
                   "product/admin/enterprise-managed-authorization/audit",
                   "product/admin/enterprise-managed-authorization/support-in-your-app"
                 ]
+              },
+              {
+                "group": "Edge Gateway",
+                "tag": "NEW",
+                "pages": [
+                  "product/admin/edge-gateway-overview",
+                  "product/admin/edge-gateway-quickstart",
+                  "product/admin/edge-gateway-setup",
+                  "product/admin/edge-gateway-inference-routing",
+                  "product/admin/edge-gateway-access",
+                  {
+                    "group": "Connect tools",
+                    "pages": [
+                      "product/admin/claude-code-edge-gateway-multipass",
+                      "product/admin/edge-gateway-codex",
+                      "product/admin/connect-edge-gateway-multipass",
+                      "product/admin/edge-gateway-connect",
+                      "product/admin/inference-api-keys"
+                    ]
+                  }
+                ]
               }
             ]
           },

product/admin/claude-code-edge-gateway-multipass.mdx

@@ -0,0 +1,146 @@
+---
+title: Use Claude Code with Edge Gateway
+description: Run Claude Code against your organization's Edge Gateway with short-lived inference tokens that C1 Multipass issues from your device session — no Anthropic API key.
+og:title: Use Claude Code with Edge Gateway - C1 docs
+og:description: Run Claude Code against your organization's Edge Gateway with short-lived inference tokens that C1 Multipass issues from your device session — no Anthropic API key.
+sidebarTitle: Claude Code
+---
+
+{/* Editor Refresh: 2026-10-28 */}
+
+<Warning>
+**Early access.** This feature is in early access, which means it's undergoing ongoing testing and development while we gather feedback, validate functionality, and improve outputs. Contact the C1 Support team if you'd like to try it out or share feedback.
+</Warning>
+
+Run Claude Code against your organization's Edge Gateway without an Anthropic API key. Claude Code calls the C1 Multipass command line tool whenever it needs a credential, and C1 Multipass returns a short-lived token that only works for inference on your Edge Gateway. Requests are attributed to you, and your organization's Edge Gateway policy applies to them.
+
+## How the Claude Code key helper works
+
+Claude Code supports an `apiKeyHelper` setting: a command it runs to get an API key. Point it at `c1-multipass inference helper`, and each call does the following:
+
+1. The C1 Multipass service uses this device's registered session to ask C1 for an inference grant on your Edge Gateway.
+2. Edge Gateway issues a bearer token limited to listing models and running inference, valid for at most five minutes, with no refresh token.
+3. The command prints the token, and Claude Code sends it to your Edge Gateway's inference URL.
+
+Claude Code calls Edge Gateway directly over HTTPS. It doesn't use the local inference or egress endpoints from [Route other tools through C1 Multipass](/product/admin/connect-edge-gateway-multipass), so you don't need to turn on routing or load credentials into your shell.
+
+## Before you begin with Claude Code and Edge Gateway
+
+Confirm the following before you start:
+
+| Requirement | Who provides it |
+| :--- | :--- |
+| macOS with C1 Multipass and its command line tool (`c1-multipass`) installed, signed in to your C1 tenant, the device registered, and the app unlocked. See [Set up Multipass](/product/admin/connect-edge-gateway-multipass#set-up-multipass). | You |
+| Access to an Edge Gateway that serves Claude models. The key helper works whether **Allow long-lived API keys** is on or off. See [Set up an Edge for inference](/product/admin/edge-gateway-setup) and [Grant access to an Edge](/product/admin/edge-gateway-access). | Your C1 admin |
+| Make sure **Cross-App Access** is on under **AI** > **Cross-App Access** so Multipass can get Edge tokens for people. The Edge's **Overview** warns if it's off. If the setting isn't available, contact the C1 Support team. See [Enable enterprise-managed authorization](/product/admin/enterprise-managed-authorization/enable). | Your C1 admin |
+| Your Edge Gateway's inference endpoint, for example `https://<your-org>-inference.edge.<your-zone>`. See [Find the Edge's connection values](/product/admin/edge-gateway-connect#find-the-edges-connection-details). | Your C1 admin |
+| Claude Code installed | You |
+
+The helper workflow on this page requires macOS. The desktop app is also available for Windows, but the inference-helper CLI and **Command line tool** installation aren't available there. For enrolled Linux hosts, see the [fleet routing setup](/product/admin/connect-edge-gateway-multipass#turn-on-edge-gateway-routing).
+
+## Check that your Edge Gateway issues inference tokens
+
+Before configuring Claude Code, confirm C1 Multipass can get a token. This command prints only the token's prefix, not the token itself:
+
+```bash
+c1-multipass inference helper --dial-only | cut -c1-14
+```
+
+The output starts with `tb_inf_at_v1.`. If the command prints an error instead, see [Troubleshoot Claude Code with Edge Gateway](#troubleshoot-claude-code-with-edge-gateway).
+
+**Optional.** List the models available to you, and confirm the Claude models you plan to use are there:
+
+```bash
+curl -s --noproxy '*' https://<your edge gateway inference host>/v1/models \
+  -H "Authorization: Bearer $(c1-multipass inference helper --dial-only)" \
+  | grep -o '"id":"[^"]*"'
+```
+
+## Configure Claude Code to use Edge Gateway
+
+Copy the settings from **Connect your tools** > **Claude Code** into `~/.claude/settings.json`. Merge them with your existing settings; don't overwrite the file.
+
+<Frame>
+  <img src="/images/product/assets/edge-how-to-connect.png" alt="The Connect your tools card with Set up Multipass collapsed, Claude Code selected, and the beginning of the settings.json configuration."/>
+</Frame>
+
+<Steps>
+<Step>
+Open `~/.claude/settings.json`, creating the file if it doesn't exist.
+</Step>
+<Step>
+Merge the following settings. Replace the inference host and the app and Edge IDs with the values from your Edge's **Connection details**. Use the inference origin without a trailing slash or `/v1` suffix for both `--edge-url` and `ANTHROPIC_BASE_URL`. Replace `<claude-route-id>` with a Claude route from your Edge's model list.
+
+```json
+{
+  "apiKeyHelper": "c1-multipass inference helper --edge-url https://<inference-host> --inference-resource https://<inference-host>/api/v1/apps/<app-id>/edges/<edge-id> --dial-only",
+  "env": {
+    "ANTHROPIC_BASE_URL": "https://<inference-host>",
+    "ANTHROPIC_MODEL": "<claude-route-id>",
+    "CLAUDE_CODE_API_KEY_HELPER_TTL_MS": "60000"
+  }
+}
+```
+
+The helper command pins the credential to this Edge's inference resource. If `c1-multipass` isn't on Claude Code's `PATH`, replace it with the installed command's full path, such as `/Users/<user>/.local/bin/c1-multipass`. The 60000-millisecond helper TTL makes Claude Code request a fresh credential every 60 seconds.
+</Step>
+<Step>
+Run a one-time prompt with other Anthropic credentials removed:
+
+```bash
+env -u ANTHROPIC_API_KEY -u ANTHROPIC_AUTH_TOKEN -u HTTPS_PROXY \
+  claude -p "Reply with exactly: edge ok"
+```
+
+`env -u` removes the two named Anthropic credentials and the uppercase `HTTPS_PROXY` variable for this command. It doesn't remove other proxy variables or system proxy settings; check those separately if the request still uses a proxy. If Claude Code asks you to approve the API key helper, approve it.
+</Step>
+</Steps>
+
+A reply of `edge ok` confirms that this prompt completed through the configured Edge. Use the same `env -u` prefix for interactive launches while other Anthropic credentials remain in your shell. Choose a model with `--model` or `/model` from your Edge's Claude routes.
+
+<Note>
+To opt in per session instead of changing your default configuration, save these settings in `~/.config/c1-edge/claude-settings.json`, preserving any existing file. Add `--settings ~/.config/c1-edge/claude-settings.json` to the `claude` command. Keep the same explicit Edge URL and resource in the helper command.
+</Note>
+
+## Keep the inference token private
+
+The key helper prints a real bearer token. Anyone holding it can run inference as you on your Edge Gateway until it expires, within five minutes.
+
+- Don't print the token to your terminal, save it to a file, or paste it anywhere. The commands on this page pass it straight to Claude Code or curl.
+- Stopping Edge Gateway routing or locking C1 Multipass doesn't revoke a token already issued. It expires on its own.
+- The token only works for inference. It can't be used for egress or other C1 APIs.
+
+## Troubleshoot Claude Code with Edge Gateway
+
+Most problems show up when you run the key helper directly:
+
+```bash
+c1-multipass inference helper --dial-only | cut -c1-14
+```
+
+| Symptom | What to do |
+| :--- | :--- |
+| `EDGE_SELECTION_REQUIRED` | You have access to more than one Edge Gateway. Select one in C1 Multipass, or use the explicit Edge URL and inference resource in [Configure Claude Code](#configure-claude-code-to-use-edge-gateway). |
+| `NO_USABLE_EDGE` | You don't have inference access on any Edge Gateway. Ask your C1 admin for access. |
+| `EDGE_GRANT_DENIED` at **C1 Edge grant** | Ask your C1 admin to check the Edge capability entitlements and the `token_exchange` event in the system log. |
+| `EDGE_GRANT_DENIED` at **Edge inference redemption** | C1 issued the grant, but the Edge refused redemption. Ask your admin to check Edge policy and runtime compatibility. The long-lived API key setting isn't a helper prerequisite. |
+| The helper reports that the C1 Multipass service isn't signed in, isn't running, or refused the connection | Open and unlock C1 Multipass, and confirm this device is registered. On macOS, open C1 Multipass from **/Applications**. |
+| The helper fails, but local routing works | Confirm that the helper uses the same Edge and inference resource as routing. **Allow long-lived API keys** doesn't control helper tokens. Share the helper's error with your C1 admin. |
+| Claude Code reports an authentication error | Run the test in [Configure Claude Code to use Edge Gateway](#configure-claude-code-to-use-edge-gateway) with `env -u`. If it succeeds there, another credential in your environment or `~/.claude/settings.json` is overriding the key helper. |
+| Claude Code reports that a model isn't available | Pick a model from your Edge Gateway's model list. |
+
+## Frequently asked questions about Claude Code with Edge Gateway
+
+<AccordionGroup>
+  <Accordion title="Do I need an Anthropic API key or a Claude subscription?">
+    No. Edge Gateway authenticates the request with the token from C1 Multipass and calls the model provider with your organization's credentials.
+  </Accordion>
+
+  <Accordion title="Why not point Claude Code at the local inference endpoint?">
+    Claude Code adds query parameters to its requests, such as `/v1/messages?beta=true`, and the local inference endpoint rejects request URLs with a query string. The key helper connects Claude Code to Edge Gateway directly.
+  </Accordion>
+
+  <Accordion title="Can I use the same approach with other tools?">
+    Yes, for any tool that runs a command to get an API key and sends it as a bearer token. Point the tool's base URL at your Edge Gateway inference URL.
+  </Accordion>
+</AccordionGroup>