Allow gateway login from org IPs

gatewayInternalNetworks

Declare the public IPv4 blocks that your organization numbers its internal network from, so /login accepts a cloud gateway there. Requires Claude Code v2.1.268 or later.

Without this key, /login connects to any gateway on a private address and nothing else. With it, /login also accepts a gateway inside a listed block, over a direct connection only. The machine's own address on that connection must also be inside the same block.

• Scope: Managed. Read only from a source on the machine: managed-settings.json, the macOS plist or Windows HKLM registry, or a policy helper. Claude Code ignores it in HKCU and server-managed settings.
• Type: array of strings, at most four IPv4 CIDR blocks, each /8 to /32, not overlapping one another, and none overlapping private space.
• Default: unset, so /login accepts only gateways on private addresses

{
  "gatewayInternalNetworks": ["203.0.113.0/24"]
}

Replace the documentation range in the example with your own block. Claude Code refuses the documentation ranges, the ranges that VPN and NAT64 clients use locally, and reserved space that no network is numbered from, such as multicast.

If an entry is invalid, or the value isn't a list of strings, /login names the problem and refuses every new gateway sign-in on the machine until you fix the value. Existing sign-ins keep working. See Allow a gateway on public address space you own for the full rules and what developers see.