MDM: Claude Code

Claude Code reads its gateway from the environment, so a managed rollout is just a matter of setting two variables on every machine. For the manual setup, see the Claude Code connect page.

ANTHROPIC_BASE_URL=https://app.tappass.ai
ANTHROPIC_API_KEY=<this user's TapPass key>

Issue a key per developer so each is a distinct governed identity.

• macOS (Intune or Jamf): push a launch agent or a managed shell profile snippet (for example a file in /etc/zshenv or a managed ~/.zprofile) that exports the two variables. Keep the file managed so users cannot remove it.
• Windows (Intune): set the two variables as machine or user environment variables through a configuration profile or a deployment script.
• Dev containers and CI: set them in the image or the pipeline’s secret store, sourced per user where possible.

Prefer a per-user key delivered from your secret store or a bootstrap endpoint over a single shared key baked into an image, so revocation and attribution stay clean.

Run one prompt in Claude Code on a managed machine and confirm a governed event for that developer in the TapPass console.