Claude Code Proxy: How to Route Claude Code Through a Gateway Without Losing Your Subscription

Claude Code has a built-in setting for this. It reads one environment variable, ANTHROPIC_BASE_URL, to decide where its requests go. Point it at a gateway, restart, and every request Claude Code makes goes through that gateway on its way to Anthropic. Nothing else about the tool changes: same commands, same files, same sign-in.

The part most guides skip is the part that decides your bill: whether you keep your Claude subscription depends on what else you set. Base URL alone keeps it. Add a credential variable and you have swapped the subscription for per-token billing. This post covers both, in the order you need them: what "proxy" means here, why you would bother, the two ways to set it up, how to check, and how to undo it.

Everything below was checked against Anthropic's Claude Code docs and Gate's docs on 18 September 2026.

Two things people mean by "Claude Code proxy"

The search term covers two different problems, and they use different settings.

A network proxy. Your company routes all outbound traffic through a proxy server, and Claude Code needs to go through it too. This is the HTTPS_PROXY case. It changes the road to Anthropic, not the cargo. Nothing is screened, saved or recorded. If that is you, skip to the network section.

An LLM gateway. A service sits between Claude Code and the model, sees every request and response, and does something useful with them: counts cost, checks for attacks, keeps a log, strips waste. This is the ANTHROPIC_BASE_URL case, and it is what the rest of this post is about. Anthropic's own docs call this an LLM gateway and support it officially, with one plain caveat worth quoting: Anthropic doesn't endorse, maintain or audit third-party gateways. You are choosing one on your own judgment, which is what this post is for.

Why put anything between Claude Code and the model

Because right now there is nothing there. Claude Code bundles up your conversation, the files it read, the tool results and the system scaffolding, sends all of it to Anthropic, and waits. Nobody counts it until the invoice or the usage meter tells you. Nobody checks whether the web page it just read contained instructions. Nobody keeps a record you could show a client.

A gateway in the path gives you three things for one change of address:

1. A meter. Every request with its model, token count and cost, in one place, across every tool you route.
2. A screen. Each request checked on the way in and each response on the way out, before the model acts on a page that talks back. This matters more the moment Claude Code can read the web or call tools, which is the moment you connect your first MCP server.
3. A record. A log of what was sent and what came back, which you can hand to someone who asks what the AI did with their material.

Some gateways add a fourth: fewer tokens. Claude Code resends the whole conversation every turn, including files it already read. A gateway that removes the duplicate before forwarding sends less, and you pay for less. That is the one we use, and we will get to it.

The rule that decides your bill

Read this before you set anything. From Anthropic's gateway docs, in plain words:

• ANTHROPIC_BASE_URL on its own sends requests through the gateway while your saved claude.ai login stays the active credential. Your Pro or Max plan and its usage limits keep applying.
• ANTHROPIC_BASE_URL plus ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN or an apiKeyHelper replaces the login for that session. The subscription is not used, its limits don't apply, and the traffic is billed per token to whoever owns the credential the gateway forwards.

So if you are on a Max plan and want to keep it, the gateway has to take its own key some other way: in a custom header, not in the Anthropic credential slot. Gate does exactly that, which is why it works with the subscription untouched. If you are on API billing anyway, either way is fine.

One more consequence: while the base URL points somewhere other than Anthropic, Remote Control is unavailable (since Claude Code v2.1.196), and the Slack and cloud-session surfaces always talk to Anthropic directly, gateway or not. If you live in Remote Control, that is a real trade-off, and we would rather you know now than after the restart.

Route Claude Code through Gate, the one-toggle way

Constellation Gate AI is the gateway we use. It calls itself "the accountability layer for AI", sits "between your agent and the model", and does the four things above: it screens every request and response for prompt injection, removes duplicate content and repeated file reads so 20% or more fewer tokens reach the model, tracks cost per request, and writes a tamper-evident audit log (all figures Gate's own, checked 18 September 2026). It is free to start and takes no card.

Gate Connect is its menu-bar app, and it is the way to go if you would rather not open a config file:

1. Create the free account at Gate and copy an API key from the dashboard (under API keys; it starts with sk-gw-).
2. Install Gate Connect for macOS, Windows or Linux. It lives in the menu bar, not as a window.
3. Paste the key into the panel and click Connect. The gateway address fills itself in; the key goes into your OS keychain, not a file.
4. Open Routing, make sure Route through Gate is on, and switch on Claude Code. One toggle can cover more than one app; Claude Code and Claude Desktop share one.
5. Quit and reopen Claude Code. On macOS, Cmd+Q rather than closing the window, or it keeps the old routing.
6. Send one message, then open the Gate dashboard. It should appear on the Messages page within seconds, with its model, cost and security result.

There is also a gate-connect command that does the same from the terminal (gate-connect connect claude-code), which is what you want if you are setting this up on more than one machine.

Affiliate disclosure, because it belongs next to the link: we earn a commission on Pro seats that start from our link. It pays for the testing budget and has no say in the verdict.

Route Claude Code through Gate, the manual way

If you prefer to see the setting, it is a short block in your Claude Code settings file. Gate's docs give two versions; this is the one that keeps your existing Anthropic sign-in:

{
  "env": {
    "ANTHROPIC_BASE_URL": "https://gateway.constellationgate.ai",
    "ANTHROPIC_CUSTOM_HEADERS": "X-Gate-Api-Key: sk-gw-YOUR-GATE-KEY\nX-Gate-Upstream-Url: https://api.anthropic.com"
  }
}

Notice what is not there: no ANTHROPIC_API_KEY. The Gate key travels in a custom header, the base URL points at Gate, and the upstream header tells Gate to forward your request, with whatever credential Claude Code already uses, to Anthropic. That is the combination that keeps the subscription per the rule above. (Gate's other version puts a Gate key in ANTHROPIC_API_KEY and bills a prepaid Gate balance per token instead; use that only if you want to pay through Gate, and check the exact address against your dashboard, since Gate lists slightly different hostnames for different setups.)

Where the block goes:

• ~/.claude/settings.json applies to every project. On Windows: %USERPROFILE%\.claude\settings.json.
• .claude/settings.local.json inside a project applies to that project only. Claude Code gitignores it when it writes it; if you create it by hand, add it to .gitignore yourself first.
• Never put a key in a project's .claude/settings.json. That file is committed and shared with everyone who clones the repository.

If you already have an env block, add the two lines to it rather than creating a second block. Then quit Claude Code fully and start it again. Custom headers count as settings that need approval when they come from a project file, so expect a prompt the first time.

Anthropic's docs suggest a shell export first, so you can test before writing anything to a file:

export ANTHROPIC_BASE_URL=https://gateway.constellationgate.ai
export ANTHROPIC_CUSTOM_HEADERS="X-Gate-Api-Key: sk-gw-YOUR-GATE-KEY
X-Gate-Upstream-Url: https://api.anthropic.com"

Shell exports last for that terminal only and do not reach an editor launched from the dock, which is the usual reason "it worked in the terminal but not in VS Code". The settings file is what makes it stick everywhere, including background agents.

Check that it took

Three checks, from cheapest to most certain:

1. /status inside Claude Code. The Status tab shows an Anthropic base URL line only when a gateway address is set. If the line is missing, the variable did not reach the session; the usual cause is a shell export in a different terminal. If a Login method line still names your claude.ai account, good: that is the subscription still being used, which is what we want.
2. The gateway's dashboard. Send any message and look for it. Gate's Messages page shows each request with model, cost and the screening verdict. Nothing there after a minute means the app was not restarted or the toggle is off.
3. A direct request. If you want to prove the gateway is reachable independent of Claude Code, Anthropic's docs give a one-token curl to $ANTHROPIC_BASE_URL/v1/messages. A response beginning {"id":"msg_ means the gateway answered; a 401 means the credential is in a header the gateway does not read.

While you are there, note two numbers with today's date: requests recorded and tokens saved. That is your baseline, and a week later the same two numbers tell you whether this was worth the restart.

What changes and what does not

What stays the same: your commands, your CLAUDE.md, your MCP servers, your sign-in, your plan. The model receives the same content and returns the same answer; Gate's compression keeps the first copy of anything and removes the repeats.

What changes:

• One more hop. Some latency. We are measuring it and will report on 30 September.
• Remote Control off, as above, while the base URL is not Anthropic's. Voice dictation is unaffected unless you also set a credential variable.
• Free records, Pro blocks. The free plan (20,000 recorded requests a month, basic compression, audit trail) shows you a flagged request; it does not stop it. Blocking, PII and credential redaction, spend caps and the full compression are Pro, at $20 per user per month (prices checked September 2026). Run free until you see the first flag, then decide.
• Your prompts pass through a third party. Gate says it does not train on them and stores only fingerprints in the audit ledger, but if a client contract forbids routing their material through another processor, read Gate's data-processing terms first. The review covers this trade-off in more detail.
• Background traffic such as version checks and telemetry still goes to Anthropic outside the gateway path. On a locked-down network that only allows egress to the gateway, set CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 to turn it off.

Claude Code behind a corporate network proxy

The other meaning of the search term, briefly, because the settings are simple and the docs are clear:

export HTTPS_PROXY=https://proxy.example.com:8080
export NO_PROXY="localhost,192.168.1.1,.example.com"
export NODE_EXTRA_CA_CERTS=/path/to/company-ca.pem

Claude Code respects HTTPS_PROXY, HTTP_PROXY and NO_PROXY in upper or lower case, accepts basic authentication in the proxy URL (http://user:pass@proxy:8080, though keep that out of scripts), and trusts a custom certificate authority through NODE_EXTRA_CA_CERTS. It does not support SOCKS proxies, and for NTLM or Kerberos authentication Anthropic's own advice is to use an LLM gateway that supports it instead. All of these can go in the same env block in settings.json, and they combine with a gateway: the network proxy carries the traffic, the gateway address says where it goes.

Your first fifteen minutes

Following the rule we apply to every tool: real input, one output, hard stop.

1. Minutes 0 to 4. Free account, copy the key, install Gate Connect, switch Claude Code on, Cmd+Q, reopen. Start here.
2. Minute 4. /status. See the base URL line. See your login still named.
3. Minutes 5 to 13. Do the task you were going to do anyway. Not a test prompt; real work.
4. Minutes 13 to 15. Dashboard, Messages page. Write down requests recorded and tokens saved, with the date. Stop.

Output: one baseline on a sticky note. If the tokens-saved number is meaningful after a week, the free plan stays. If anything got flagged, or you see an e-mail address in a log that should not be there, that is the day Pro pays for itself. The calculator on our Gate page does the arithmetic from your monthly spend.

How to undo it

Gate Connect: switch Claude Code off in Routing, restart the app. Manual: delete the two lines from the env block, or unset the exports, restart. /status should no longer show a base URL line. Your saved login was never touched, so there is nothing to sign back into.

That is the whole thing. One variable decides where Claude Code sends its requests; one more decides who pays. Set the first, leave the second alone, and you have a meter, a screen and a record in front of a tool that had none of them this morning.

We run our own Claude Code sessions through Gate. The first two weeks of token numbers, and what happened when we pulled the gateway's plug mid-session, go out in the newsletter and on the Gate page on 30 September 2026.