# Route a Claude subscription through Aperture

Last validated Jun 27, 2026

\[Missing snippet: aperture\_release\_note.mdx]

In [passthrough mode][kb-use-passthrough-mode], Aperture forwards each client's own credential to the upstream provider instead of injecting a shared API key. This guide uses passthrough to route a Claude Pro or Max subscription: Claude Code signs in to the subscription and holds an OAuth token, and Aperture forwards that token to Anthropic unchanged. Each user authenticates to Anthropic as themselves, and you get Aperture's identity, logging, and policy enforcement without re-issuing keys.

This guide covers the end-to-end setup: the Anthropic provider on the Aperture side, and Claude Code on the client side. For the full passthrough mechanism and `auth_mode` reference, refer to [set up passthrough mode][kb-use-passthrough-mode].

\[Missing snippet: aperture\_any\_provider.mdx]

## Prerequisites

Before you begin, you need:

* An [Aperture instance][kb-get-started] accessible from your device, and admin access to edit its configuration.
* A grant that permits the Anthropic models for the Tailscale identities that will use them. Aperture lists and routes only granted models.
* A Claude Pro or Max subscription for each user, and [Claude Code][xt-claude-code] installed and able to sign in to that subscription.

## Configure the Anthropic provider

Define an Anthropic provider with `auth_mode` set to `passthrough` so Aperture forwards the client's OAuth token.

1. \[Missing snippet: aperture\_admin\_nav.mdx]

2. Add a provider under the `providers` map, replacing the placeholders with your values:

   ```json
   "providers": {
     "anthropic-passthrough": {
       "baseurl": "https://api.anthropic.com",
       "authorization": "x-api-key",
       "auth_mode": "passthrough",
       "models": ["claude-opus-4-8"],
       "compatibility": {
         "anthropic_messages": true
       }
     }
   }
   ```

   * `authorization` is `x-api-key` for Anthropic. Aperture forwards whichever credential the client sends, including a `Bearer` OAuth token.
   * No `apikey` is configured, so this provider is passthrough-only: it works solely from each client's subscription token. Add a fallback `apikey` if you also want these models to work in the chat UI, which sends server-side requests that carry no client credential.

   \[Missing snippet: aperture\_model\_wildcards\_note.mdx]

3. Save the configuration. Aperture hot-reloads it, so no restart is required. A successful save confirms the block passed validation.

## Sign in Claude Code with the subscription

Point Claude Code at Aperture and let it send its subscription OAuth token. Set only the base URL.

\[Missing snippet: aperture\_tls\_warning.mdx]

1. Sign in to your Claude subscription in Claude Code using `claude` then `/login`, or the IDE sign-in flow.
2. Create or edit `~/.claude/settings.json` and set the Aperture URL:

   ```json
   {
     "env": {
       "ANTHROPIC_BASE_URL": "http://<aperture-hostname>"
     }
   }
   ```

   Do not set `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN`. Setting either makes Claude Code send that value instead of its OAuth token, which suppresses the credential you want to pass through.

> **Tip:**
>
> You can set the base URL with an environment variable instead of the settings file:
>
> ```shell
> export ANTHROPIC_BASE_URL="http://<aperture-hostname>"
> # Do not set ANTHROPIC_API_KEY; let the OAuth token pass through.
> ```

## Verify the connection

1. Send a test message in Claude Code.
2. Open the Aperture dashboard at `http://<aperture-hostname>/ui/` and confirm the request appears on the **Logs** page (admin only).

If a request fails with a `401` error, confirm Claude Code is signed in to the subscription and that no API key or auth token is set on the client. If the request never reaches Aperture, confirm `ANTHROPIC_BASE_URL` points at the Aperture host. For more checks, refer to the [passthrough troubleshooting steps][kb-use-passthrough-mode].

## What routes through Aperture

Only inference requests (`/v1/messages`) route through Aperture. Claude Code sends OAuth sign-in and token refresh requests directly to `api.anthropic.com`, bypassing `ANTHROPIC_BASE_URL`. Aperture never handles authentication or token refresh. It only authenticates inference requests by Tailscale identity before forwarding them to Anthropic.

\[Missing snippet: aperture\_provider\_next\_steps.mdx]

[kb-get-started]: /docs/aperture/get-started

[kb-use-passthrough-mode]: /docs/aperture/how-to/use-passthrough-mode

[xt-claude-code]: https://docs.anthropic.com/en/docs/claude-code