Skip to main content
Claude Code with the Consus Gateway supports two compliance configurations — ITAR and FedRAMP High (see Step 2). They are identical except for the model IDs and their :level suffix. Pick the one your data classification and authorization require, and do not mix levels within a single profile.The gateway enforces the compliance boundary for the models it serves, but it does not control client-side behavior — local tool execution, file access, outbound destinations, etc. Client-side behavior is the customer’s responsibility.

​
Before you start

You need:
  • Claude Code installed. See the Claude Code docs if you don’t have it yet.
  • A Consus API key. Get one from your Consus admin.

​
Step 1 (recommended): Set up an isolated Consus profile

If you use Claude Code for anything else (personal account or another organization) we recommend setting up an isolated Consus Gateway profile. This keeps your Consus credentials and settings fully isolated. Add this alias to your shell profile (~/.zshrc or ~/.bashrc): 
alias claude-gateway='CLAUDE_CONFIG_DIR=~/.claude-gateway claude'
Then source ~/.zshrc (or source ~/.bashrc) to pick up the alias. Run it once to bootstrap the profile, then exit with Ctrl+C: 
claude-gateway
This creates ~/.claude-gateway/settings.json, which you’ll edit in the next step. The rest of this guide uses claude-gateway and ~/.claude-gateway/ throughout. If you skip this step, substitute claude and ~/.claude/.

​
Step 2: Configure your gateway settings

Open ~/.claude-gateway/settings.json and replace its contents with one of the configurations below — the one that matches your data classification. The two are identical except for the model IDs.

​
Option A — ITAR

Use this when handling ITAR / export-controlled data. Every call is served by Claude Sonnet 4.5 with ITAR authorization on AWS GovCloud Bedrock. 
{
  "apiKeyHelper": "echo <CONSUS_API_KEY>",
  "model": "claude-sonnet-4-5:il5+itar",
  "availableModels": ["claude-sonnet-4-5:il5+itar"],
  "env": {
    "ANTHROPIC_DEFAULT_SONNET_MODEL": "claude-sonnet-4-5:il5+itar",
    "ANTHROPIC_DEFAULT_HAIKU_MODEL": "claude-sonnet-4-5:il5+itar",
    "ANTHROPIC_BASE_URL": "https://api.consus.io"
  }
}

​
Option B — FedRAMP High

Use this for FedRAMP High (non-ITAR) workloads. Same structure as Option A — only the model IDs change to carry the :fedramp-high level, which gives you Claude Opus 4.6, Sonnet 4.6, and Haiku 4.5 (a real Haiku model for background calls). 
{
  "apiKeyHelper": "echo <CONSUS_API_KEY>",
  "model": "claude-opus-4-6:fedramp-high",
  "availableModels": [
    "claude-opus-4-6:fedramp-high",
    "claude-sonnet-4-6:fedramp-high",
    "claude-haiku-4-5:fedramp-high"
  ],
  "env": {
    "ANTHROPIC_DEFAULT_OPUS_MODEL": "claude-opus-4-6:fedramp-high",
    "ANTHROPIC_DEFAULT_SONNET_MODEL": "claude-sonnet-4-6:fedramp-high",
    "ANTHROPIC_DEFAULT_HAIKU_MODEL": "claude-haiku-4-5:fedramp-high",
    "ANTHROPIC_BASE_URL": "https://api.consus.io"
  }
}
Replace <CONSUS_API_KEY> with your actual key.
Model IDs must include a compliance level (e.g. claude-sonnet-4-5:il5+itar). A bare model name without a :level suffix is rejected with a 400. Pick the model and level your authorization requires — run curl -H "x-api-key: $CONSUS_API_KEY" https://api.consus.io/v1/models to see what’s available.
Do not commit ~/.claude-gateway/settings.json to source control with your key in it.
Conflicting shell variables: If ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN are exported in your shell, they take precedence over apiKeyHelper and will route Claude Code around the gateway. Unset them with unset ANTHROPIC_API_KEY ANTHROPIC_AUTH_TOKEN and remove any export lines for them from ~/.zshrc or ~/.bashrc.Previous login: If you previously logged in to Claude Code against api.anthropic.com, run /logout inside a Claude Code session to clear cached credentials before the gateway configuration takes effect.

​
Step 3: Start your session

cd /path/to/your/project
claude-gateway
That’s it. Every request now routes through Consus Gateway with ITAR authorization.

​
Step 4: Verify

Inside the Claude Code session, run /status: 
> /status
Auth token:         apiKeyHelper
Anthropic base URL: https://api.consus.io
Both lines must match. If Auth token shows anything other than apiKeyHelper (for example ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN), one of those environment variables is still set in your shell — see the Conflicting shell variables note in Step 2. Then ask Claude Code to do something real: 
> create a file hello.py with a fibonacci function and run it
The file should appear on disk and the run output should be the actual numbers, not a hallucinated transcript.

​
What gets served

Every request from Claude Code — coding turns, background Haiku-class calls, tool use — is served by the model you configure in Step 2. With Option A that’s Claude Sonnet 4.5 with ITAR authorization for every call; with Option B it’s Claude Opus 4.6 / Sonnet 4.6 at FedRAMP High. The gateway routes each request to whichever government-authorized provider hosts that model at the requested compliance level (AWS GovCloud Bedrock, GCP Assured Workloads Vertex AI); the compliance boundary is enforced at the gateway architecture level. The response header x-consus-served-model confirms the model that served each successful request (e.g. claude-sonnet-4-5).

​
What each setting does

apiKeyHelper : A shell command Claude Code runs to obtain the API key. echo <key> is the simplest form — Claude Code reads the key off stdout and sends it as the x-api-key header on every request. model and availableModels : Pin Claude Code’s client-side model selection to the model and compliance level you want served. Must include a :level suffix. env.ANTHROPIC_BASE_URL : Routes Claude Code’s requests to the gateway (https://api.consus.io) instead of api.anthropic.com. The gateway exposes the same Anthropic Messages API surface. env.ANTHROPIC_DEFAULT_OPUS_MODEL, env.ANTHROPIC_DEFAULT_SONNET_MODEL, and env.ANTHROPIC_DEFAULT_HAIKU_MODEL : Override Claude Code’s default model IDs for its Opus, Sonnet, and background (Haiku-class) tiers. Each must be a full model:level ID; set them to the model you want serving that class of call. Option A only needs the Sonnet and Haiku tiers; Option B adds the Opus tier.