Claude Code

Claude Code with the Consus Gateway supports two compliance configurations — ITAR and FedRAMP High (see Step 2). They are identical except for the model IDs and their :level suffix. Pick the one your data classification and authorization require, and do not mix levels within a single profile.The gateway enforces the compliance boundary for the models it serves, but it does not control client-side behavior — local tool execution, file access, outbound destinations, etc. Client-side behavior is the customer’s responsibility.

Before you start

You need:

Claude Code installed. See the Claude Code docs if you don’t have it yet.
A Consus API key. Get one from your Consus admin.

Step 1 (recommended): Set up an isolated Consus profile

If you use Claude Code for anything else (personal account or another organization) we recommend setting up an isolated Consus Gateway profile. This keeps your Consus credentials and settings fully isolated. Add this alias to your shell profile (~/.zshrc or ~/.bashrc):

alias claude-gateway='CLAUDE_CONFIG_DIR=~/.claude-gateway claude'

Then source ~/.zshrc (or source ~/.bashrc) to pick up the alias. Run it once to bootstrap the profile, then exit with Ctrl+C:

claude-gateway

This creates ~/.claude-gateway/settings.json, which you’ll edit in the next step. The rest of this guide uses claude-gateway and ~/.claude-gateway/ throughout. If you skip this step, substitute claude and ~/.claude/.

Step 2: Configure your gateway settings

Open ~/.claude-gateway/settings.json and replace its contents with one of the configurations below — the one that matches your data classification. The two are identical except for the model IDs.

Option A — ITAR

Use this when handling ITAR / export-controlled data. Every call is served by a Claude model with ITAR authorization on AWS GovCloud Bedrock: Claude Opus 5 for the heaviest work (with Claude Opus 4.8 still available), Claude Sonnet 5 for standard calls, and Claude Sonnet 4.5 for background calls. There is no Haiku with ITAR authorization, so a Sonnet fills the background slot. Opus 4.8 is authorized for ITAR only, so it uses the standalone :itar ID (no compliance level); Opus 5’s ITAR traffic likewise uses :itar (its FedRAMP-level ids are served from Vertex AI — see Option B); both Sonnets are authorized at IL5 and ITAR, so they carry :il5+itar.

{
  "apiKeyHelper": "echo $CONSUS_API_KEY",
  "model": "claude-opus-5:itar",
  "availableModels": [
    "claude-opus-5:itar",
    "claude-opus-4-8:itar",
    "claude-sonnet-5:il5+itar",
    "claude-sonnet-4-5:il5+itar"
  ],
  "env": {
    "ANTHROPIC_DEFAULT_OPUS_MODEL": "claude-opus-5:itar",
    "ANTHROPIC_DEFAULT_SONNET_MODEL": "claude-sonnet-5:il5+itar",
    "ANTHROPIC_DEFAULT_HAIKU_MODEL": "claude-sonnet-4-5:il5+itar",
    "ANTHROPIC_BASE_URL": "https://api.consus.io"
  }
}

Why Sonnet 4.5 in the background slot. Claude Code uses its background model (ANTHROPIC_DEFAULT_HAIKU_MODEL) for internal tasks like session-title generation, and those calls request structured outputs via output_config.format. Consus does not yet support that parameter on Claude Sonnet 5, so those calls return 400 invalid_request_error. Claude Code does not surface the failure — your session looks healthy while background tasks silently stop working. Sonnet 4.5 supports structured outputs today and carries the same IL5 + ITAR authorization, so it is the correct choice for this slot. Sonnet 5 remains fully supported for conversation, which never uses this parameter.

If you’d rather keep costs flat and route standard calls through one model, set model, availableModels, ANTHROPIC_DEFAULT_OPUS_MODEL, and ANTHROPIC_DEFAULT_SONNET_MODEL to claude-sonnet-5:il5+itar — but leave ANTHROPIC_DEFAULT_HAIKU_MODEL on claude-sonnet-4-5:il5+itar for the reason above.

Option B — FedRAMP High

Use this for FedRAMP High (non-ITAR) workloads. Same structure as Option A — only the model IDs change to carry the :fedramp-high level, which gives you Claude Opus 5 (served from Vertex AI), Opus 4.8, Sonnet 5, and Haiku 4.5 (a real Haiku model for background calls).

{
  "apiKeyHelper": "echo $CONSUS_API_KEY",
  "model": "claude-opus-5:fedramp-high",
  "availableModels": [
    "claude-opus-5:fedramp-high",
    "claude-opus-4-8:fedramp-high",
    "claude-opus-4-7:fedramp-high",
    "claude-sonnet-5:fedramp-high",
    "claude-sonnet-4-6:fedramp-high",
    "claude-haiku-4-5:fedramp-high"
  ],
  "env": {
    "ANTHROPIC_DEFAULT_OPUS_MODEL": "claude-opus-5:fedramp-high",
    "ANTHROPIC_DEFAULT_SONNET_MODEL": "claude-sonnet-5:fedramp-high",
    "ANTHROPIC_DEFAULT_HAIKU_MODEL": "claude-haiku-4-5:fedramp-high",
    "ANTHROPIC_BASE_URL": "https://api.consus.io"
  }
}

apiKeyHelper reads your key from the CONSUS_API_KEY environment variable, so export it in your shell before launching Claude Code:

export CONSUS_API_KEY="your-actual-key"

Add that line to your ~/.zshrc or ~/.bashrc to make it persist across sessions.

Model IDs must include a compliance level (e.g. claude-sonnet-4-5:il5+itar). A bare model name without a :level suffix is rejected with a 400. Pick the model and level your authorization requires — run curl -H "x-api-key: $CONSUS_API_KEY" https://api.consus.io/v1/models to see what’s available.

Keep your CONSUS_API_KEY out of source control — set it via the environment as shown above rather than hardcoding the key into ~/.claude-gateway/settings.json.

Conflicting shell variables: If ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN are exported in your shell, they take precedence over apiKeyHelper and will route Claude Code around the gateway. Unset them with unset ANTHROPIC_API_KEY ANTHROPIC_AUTH_TOKEN and remove any export lines for them from ~/.zshrc or ~/.bashrc.Previous login: If you previously logged in to Claude Code against api.anthropic.com, run /logout inside a Claude Code session to clear cached credentials before the gateway configuration takes effect.

Step 3: Start your session

cd /path/to/your/project
claude-gateway

That’s it. Every request now routes through Consus Gateway with ITAR authorization.

Step 4: Verify

Inside the Claude Code session, run /status:

> /status
Auth token:         apiKeyHelper
Anthropic base URL: https://api.consus.io

Both lines must match. If Auth token shows anything other than apiKeyHelper (for example ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN), one of those environment variables is still set in your shell — see the Conflicting shell variables note in Step 2. Then ask Claude Code to do something real:

> create a file hello.py with a fibonacci function and run it

The file should appear on disk and the run output should be the actual numbers, not a hallucinated transcript.

What gets served

Every request from Claude Code — coding turns, background Haiku-class calls, tool use — is served by the model you configure in Step 2. With Option A that’s Claude Opus 4.8 (heavy work) and Claude Sonnet 4.5 (standard and background), both with ITAR authorization; with Option B it’s Claude Opus 4.8 / Sonnet 4.6 at FedRAMP High. The gateway routes each request to whichever government-authorized provider hosts that model at the requested compliance level (AWS GovCloud Bedrock, GCP Assured Workloads Vertex AI); the compliance boundary is enforced at the gateway architecture level. The response header x-consus-served-model confirms the model that served each successful request (e.g. claude-sonnet-4-5).

What each setting does

apiKeyHelper : A shell command Claude Code runs to obtain the API key. echo <key> is the simplest form — Claude Code reads the key off stdout and sends it as the x-api-key header on every request. model and availableModels : Pin Claude Code’s client-side model selection to the model and compliance level you want served. Must include a :level suffix. env.ANTHROPIC_BASE_URL : Routes Claude Code’s requests to the gateway (https://api.consus.io) instead of api.anthropic.com. The gateway exposes the same Anthropic Messages API surface. env.ANTHROPIC_DEFAULT_OPUS_MODEL, env.ANTHROPIC_DEFAULT_SONNET_MODEL, and env.ANTHROPIC_DEFAULT_HAIKU_MODEL : Override Claude Code’s default model IDs for its Opus, Sonnet, and background (Haiku-class) tiers. Each must be a full model:level ID; set them to the model you want serving that class of call. Option A only needs the Sonnet and Haiku tiers; Option B adds the Opus tier.

Product

Getting Started

API Reference

Integrations

Before you start

Step 1 (recommended): Set up an isolated Consus profile

Step 2: Configure your gateway settings

Option A — ITAR

Option B — FedRAMP High

Step 3: Start your session

Step 4: Verify

What gets served

What each setting does

​Before you start

​Step 1 (recommended): Set up an isolated Consus profile

​Step 2: Configure your gateway settings

​Option A — ITAR

​Option B — FedRAMP High

​Step 3: Start your session

​Step 4: Verify

​What gets served

​What each setting does

Before you start

Step 1 (recommended): Set up an isolated Consus profile

Step 2: Configure your gateway settings

Option A — ITAR

Option B — FedRAMP High

Step 3: Start your session

Step 4: Verify

What gets served

What each setting does