> ## Documentation Index
> Fetch the complete documentation index at: https://gateway.consus.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Claude Code

> Use Claude Code with ITAR and FedRAMP High data

<Warning>
  Claude Code with the Consus Gateway supports **two compliance configurations — ITAR and FedRAMP High** (see Step 2). They are identical except for the model IDs and their `:level` suffix. Pick the one your data classification and authorization require, and do not mix levels within a single profile.

  The gateway enforces the compliance boundary for the models it serves, but it does **not** control client-side behavior — local tool execution, file access, outbound destinations, etc. Client-side behavior is the customer's responsibility.
</Warning>

<video width="100%" style={{ aspectRatio: "16/9" }} controls>
  <source src="https://mintcdn.com/consusindustries/z0WHTwtdzOyhRI6X/assets/claude_code.mp4?fit=max&auto=format&n=z0WHTwtdzOyhRI6X&q=85&s=4e4638d1f70c6cf2f885cb6753f2eca7" type="video/mp4" data-path="assets/claude_code.mp4" />
</video>

## Before you start

You need:

* **Claude Code installed.** See the [Claude Code docs](https://docs.claude.com/en/docs/claude-code) if you don't have it yet.
* **A Consus API key.** Get one from your Consus admin.

## Step 1 (recommended): Set up an isolated Consus profile

If you use Claude Code for anything else (personal account or another organization) we recommend setting up an isolated Consus Gateway profile. This keeps your Consus credentials and settings fully isolated.

Add this alias to your shell profile (`~/.zshrc` or `~/.bashrc`):

```bash theme={null}
alias claude-gateway='CLAUDE_CONFIG_DIR=~/.claude-gateway claude'
```

Then `source ~/.zshrc` (or `source ~/.bashrc`) to pick up the alias.

Run it once to bootstrap the profile, then exit with Ctrl+C:

```bash theme={null}
claude-gateway
```

This creates `~/.claude-gateway/settings.json`, which you'll edit in the next step.

The rest of this guide uses `claude-gateway` and `~/.claude-gateway/` throughout. If you skip this step, substitute `claude` and `~/.claude/`.

## Step 2: Configure your gateway settings

Open `~/.claude-gateway/settings.json` and replace its contents with **one** of the configurations below — the one that matches your data classification. The two are identical except for the model IDs.

### Option A — ITAR

Use this when handling ITAR / export-controlled data. Every call is served by a Claude model with ITAR authorization on AWS GovCloud Bedrock: **Claude Opus 5** for the heaviest work (with **Claude Opus 4.8** still available), **Claude Sonnet 5** for standard calls, and **Claude Sonnet 4.5** for background calls. There is no Haiku with ITAR authorization, so a Sonnet fills the background slot. Opus 4.8 is authorized for ITAR only, so it uses the standalone `:itar` ID (no compliance level); Opus 5's ITAR traffic likewise uses `:itar` (its FedRAMP-level ids are served from Vertex AI — see Option B); both Sonnets are authorized at IL5 and ITAR, so they carry `:il5+itar`.

```json theme={null}
{
  "apiKeyHelper": "echo $CONSUS_API_KEY",
  "model": "claude-opus-5:itar",
  "availableModels": [
    "claude-opus-5:itar",
    "claude-opus-4-8:itar",
    "claude-sonnet-5:il5+itar",
    "claude-sonnet-4-5:il5+itar"
  ],
  "env": {
    "ANTHROPIC_DEFAULT_OPUS_MODEL": "claude-opus-5:itar",
    "ANTHROPIC_DEFAULT_SONNET_MODEL": "claude-sonnet-5:il5+itar",
    "ANTHROPIC_DEFAULT_HAIKU_MODEL": "claude-sonnet-4-5:il5+itar",
    "ANTHROPIC_BASE_URL": "https://api.consus.io"
  }
}
```

<Note>
  **Why Sonnet 4.5 in the background slot.** Claude Code uses its background model
  (`ANTHROPIC_DEFAULT_HAIKU_MODEL`) for internal tasks like session-title generation, and
  those calls request [structured outputs](https://platform.claude.com/docs/en/build-with-claude/structured-outputs)
  via `output_config.format`. Consus does not yet support that parameter on Claude Sonnet 5,
  so those calls return `400 invalid_request_error`. Claude Code does not surface the
  failure — your session looks healthy while background tasks silently stop working.
  Sonnet 4.5 supports structured outputs today and carries the same IL5 + ITAR
  authorization, so it is the correct choice for this slot. Sonnet 5 remains fully
  supported for conversation, which never uses this parameter.
</Note>

If you'd rather keep costs flat and route standard calls through one model, set `model`,
`availableModels`, `ANTHROPIC_DEFAULT_OPUS_MODEL`, and `ANTHROPIC_DEFAULT_SONNET_MODEL` to
`claude-sonnet-5:il5+itar` — but leave `ANTHROPIC_DEFAULT_HAIKU_MODEL` on
`claude-sonnet-4-5:il5+itar` for the reason above.

### Option B — FedRAMP High

Use this for FedRAMP High (non-ITAR) workloads. Same structure as Option A — **only the model IDs change** to carry the `:fedramp-high` level, which gives you **Claude Opus 5** (served from Vertex AI), **Opus 4.8**, **Sonnet 5**, and **Haiku 4.5** (a real Haiku model for background calls).

```json theme={null}
{
  "apiKeyHelper": "echo $CONSUS_API_KEY",
  "model": "claude-opus-5:fedramp-high",
  "availableModels": [
    "claude-opus-5:fedramp-high",
    "claude-opus-4-8:fedramp-high",
    "claude-opus-4-7:fedramp-high",
    "claude-sonnet-5:fedramp-high",
    "claude-sonnet-4-6:fedramp-high",
    "claude-haiku-4-5:fedramp-high"
  ],
  "env": {
    "ANTHROPIC_DEFAULT_OPUS_MODEL": "claude-opus-5:fedramp-high",
    "ANTHROPIC_DEFAULT_SONNET_MODEL": "claude-sonnet-5:fedramp-high",
    "ANTHROPIC_DEFAULT_HAIKU_MODEL": "claude-haiku-4-5:fedramp-high",
    "ANTHROPIC_BASE_URL": "https://api.consus.io"
  }
}
```

`apiKeyHelper` reads your key from the `CONSUS_API_KEY` environment variable, so export it in your shell before launching Claude Code:

```bash theme={null}
export CONSUS_API_KEY="your-actual-key"
```

Add that line to your `~/.zshrc` or `~/.bashrc` to make it persist across sessions.

<Warning>
  Model IDs must include a compliance level (e.g. `claude-sonnet-4-5:il5+itar`). A bare model name without a `:level` suffix is rejected with a 400. Pick the model and level your authorization requires — run `curl -H "x-api-key: $CONSUS_API_KEY" https://api.consus.io/v1/models` to see what's available.
</Warning>

<Warning>
  Keep your `CONSUS_API_KEY` out of source control — set it via the environment as shown above rather than hardcoding the key into `~/.claude-gateway/settings.json`.
</Warning>

<Note>
  **Conflicting shell variables:** If `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN` are exported in your shell, they take precedence over `apiKeyHelper` and will route Claude Code around the gateway. Unset them with `unset ANTHROPIC_API_KEY ANTHROPIC_AUTH_TOKEN` and remove any `export` lines for them from `~/.zshrc` or `~/.bashrc`.

  **Previous login:** If you previously logged in to Claude Code against `api.anthropic.com`, run `/logout` inside a Claude Code session to clear cached credentials before the gateway configuration takes effect.
</Note>

## Step 3: Start your session

```bash theme={null}
cd /path/to/your/project
claude-gateway
```

That's it. Every request now routes through Consus Gateway with ITAR authorization.

## Step 4: Verify

Inside the Claude Code session, run `/status`:

```
> /status
Auth token:         apiKeyHelper
Anthropic base URL: https://api.consus.io
```

Both lines must match. If `Auth token` shows anything other than `apiKeyHelper` (for example `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN`), one of those environment variables is still set in your shell — see the **Conflicting shell variables** note in Step 2.

Then ask Claude Code to do something real:

```
> create a file hello.py with a fibonacci function and run it
```

The file should appear on disk and the run output should be the actual numbers, not a hallucinated transcript.

## What gets served

Every request from Claude Code — coding turns, background Haiku-class calls, tool use — is served by the model you configure in Step 2. With **Option A** that's Claude Opus 4.8 (heavy work) and Claude Sonnet 4.5 (standard and background), both with ITAR authorization; with **Option B** it's Claude Opus 4.8 / Sonnet 4.6 at FedRAMP High. The gateway routes each request to whichever government-authorized provider hosts that model at the requested compliance level (AWS GovCloud Bedrock, GCP Assured Workloads Vertex AI); the compliance boundary is enforced at the gateway architecture level.

The response header `x-consus-served-model` confirms the model that served each successful request (e.g. `claude-sonnet-4-5`).

## What each setting does

`apiKeyHelper`
: A shell command Claude Code runs to obtain the API key. `echo <key>` is the simplest form — Claude Code reads the key off stdout and sends it as the `x-api-key` header on every request.

`model` and `availableModels`
: Pin Claude Code's client-side model selection to the model and compliance level you want served. Must include a `:level` suffix.

`env.ANTHROPIC_BASE_URL`
: Routes Claude Code's requests to the gateway (`https://api.consus.io`) instead of `api.anthropic.com`. The gateway exposes the same Anthropic Messages API surface.

`env.ANTHROPIC_DEFAULT_OPUS_MODEL`, `env.ANTHROPIC_DEFAULT_SONNET_MODEL`, and `env.ANTHROPIC_DEFAULT_HAIKU_MODEL`
: Override Claude Code's default model IDs for its Opus, Sonnet, and background (Haiku-class) tiers. Each must be a full `model:level` ID; set them to the model you want serving that class of call. Option A only needs the Sonnet and Haiku tiers; Option B adds the Opus tier.