Claude Desktop
Claude Desktop can send its inference to a gateway of your choice instead of Anthropic’s servers. Point that gateway at TapPass and every Chat, Cowork, and Code session is governed: identity resolved, policy evaluated, input and output scanned, and the call audited, before it reaches the model.
This is a built-in Claude Desktop feature, under Developer settings. It is not a plugin or a hack.
Step 1. Enable Developer Mode
Section titled “Step 1. Enable Developer Mode”- Open
Help → Troubleshooting. - Click Enable Developer Mode.
- Fully quit and relaunch Claude Desktop. A new
Developermenu appears in the menu bar.
Step 2. Open the inference settings
Section titled “Step 2. Open the inference settings”Open Developer → Configure Third-Party Inference.... The window opens on the
Connection tab.
Step 3. Fill in the Connection fields
Section titled “Step 3. Fill in the Connection fields”Set Source to Gateway, then complete the fields. This table maps every field in the panel to what to enter and where to get it.
| Panel field | What to enter | Where to get it |
|---|---|---|
| Source / Connection | Gateway |
dropdown |
| Credential kind | Static API key (recommended) |
see credential options |
| Gateway base URL | https://app.tappass.ai |
ingredient 1 |
| Gateway API key | your TapPass agent API key | App: Agents → your agent → Connect. CLI: tappass auth developer-key create |
| Gateway auth scheme | Bearer |
TapPass also accepts x-api-key |
| Model list | your prefixed model IDs, default first | App: Models. CLI: tappass model list. API: GET /v1/models |
| Stream idle timeout | 300 (raise toward 1800 for long Cowork loops) |
your call |
| Custom inference headers | leave empty | routing/tenant headers only, never credentials |
Click Apply Changes.
Credential options
Section titled “Credential options”The Credential kind dropdown offers four sources.
| Credential kind | Status with TapPass | Notes |
|---|---|---|
| Static API key | Supported today | Paste a TapPass agent API key. Simplest and reliable. Pins the device to one agent identity. |
| Interactive sign-in | Supported against TapPass’s own sign-in | A per-user token is used, so one config serves many users as distinct identities. |
| Identity provider (OIDC / external-idp) | Roadmap | Sends your IdP’s token (for example Microsoft Entra) straight to the gateway. TapPass’s gateway does not yet validate arbitrary external IdP tokens; it validates TapPass credentials. Use Static API key until gateway OIDC resource-server mode ships. |
| Credential helper (script) | Supported | A local script mints/refreshes a short-lived TapPass token for per-user identity without a shared key. |
If the panel shows “Connection needs Identity provider (OIDC)”, the Credential kind is set to the external IdP option. Switch it to Static API key and the blocker clears.
Step 4. Set the model list
Section titled “Step 4. Set the model list”Leave discovery off and set the list explicitly, using provider-prefixed IDs, default first:
anthropic/claude-sonnet-4-5-20250929anthropic/claude-opus-4-1To see the exact IDs your org has enabled, open Models in the app. From the terminal or API instead:
tappass model list # CLIcurl -s https://app.tappass.ai/v1/models \ -H "Authorization: Bearer $TAPPASS_KEY" | jq '.data[].id' # APIStep 5. Verify
Section titled “Step 5. Verify”- Start a new Chat and send a message.
- In the TapPass console, find the agent whose key you used.
- Confirm a governed event appears for it.
If the model answers but no event appears, Claude Desktop is still talking to
Anthropic directly. Re-check that Source is Gateway, the base URL has no path,
and the key is valid.
Fleet rollout (managed config)
Section titled “Fleet rollout (managed config)”Rolling Claude Desktop out to many machines? Point it at a per-user bootstrap config URL and push that through your MDM, so each user gets their own key with read-only settings. Full steps, the overlay JSON, and the Intune and Jamf payloads are on MDM: Claude Desktop.
Troubleshooting
Section titled “Troubleshooting”| Symptom | Cause | Fix |
|---|---|---|
| “Gateway /v1/models returned 0 usable models” | discovery response shape mismatch | set inferenceModels explicitly, discovery off |
| 401 / 403 on every message | not a valid TapPass gateway credential | use an agent API key or PAT |
model_not_found with a hint |
unprefixed model ID | use the full provider/model ID |
| Blocked on “needs Identity provider (OIDC)” | Credential kind set to external IdP | switch to Static API key |
| Model answers but no audit event | still hitting the provider directly | re-check Source is Gateway, base URL has no path |
Local development
Section titled “Local development”# Claude Code equivalent for a local TapPassANTHROPIC_BASE_URL=http://localhost:9620 claudeFor Claude Desktop, set Gateway base URL to http://localhost:9620 and paste a
dev agent key.