Claude Code Routing Rules

Why claude.ai alone isn't enough

Claude Code's official enterprise network configuration doc lists the URLs it needs at runtime. The four core ones are:

api.anthropic.com — API requests, WebFetch domain safety check, feature flags, telemetry events
claude.ai — claude.ai account authentication
claude.com — Sign-in page (redirects to claude.ai), WebFetch documentation lookups
platform.claude.com — OAuth token exchange / refresh / revocation — required for both account types

Note: several widely circulated routing lists still include statsig.anthropic.com, sentry.io and cdn.anthropic.com. None of these are in the official requirements any more (telemetry moved to Datadog), and two of them no longer resolve in DNS at all. Every entry below was checked against the official doc, with the verification date noted.

The one everyone misses: platform.claude.com

The official doc states this host handles OAuth token exchange, refresh and revocation — not only for Console accounts, but for claude.ai sign-ins too. Yet almost every routing list in circulation omits it.

Missing it is not merely a lost feature: token refresh then goes out over your direct connection, so the refresh request's exit IP no longer matches your API traffic — precisely the kind of inconsistency risk systems look for. The symptom is subtle: you simply get logged out at random.

Full routing list (grouped as in the official doc)

Core requirements

Missing any one of these breaks sign-in or conversation

api.anthropic.com: API requests, WebFetch domain safety check, feature flags, telemetry events
claude.ai: claude.ai account authentication
claude.com: Sign-in page (redirects to claude.ai), WebFetch documentation lookups
platform.claude.com: OAuth token exchange / refresh / revocation — required for both account types

Feature dependent

Needed only if you use the corresponding feature

mcp-proxy.anthropic.com: MCP connector traffic from claude.ai
downloads.claude.ai: Plugin executable downloads, native installer and auto-updater
bridge.claudeusercontent.com: Claude in Chrome extension WebSocket bridge
*.frame.claudeusercontent.com: Artifact content reads
registry.npmjs.org: Plugin installs, npx-launched MCP servers, npm/bun installs of Claude Code itself
storage.googleapis.com: Plugin metadata and install counts, artifact uploads
code.claude.com: Built-in documentation lookups (claude-code-guide agent and pre-approved WebFetch)
raw.githubusercontent.com: Changelog feed for /release-notes
formulae.brew.sh: Update checks on Homebrew installs; other install methods never contact it

Telemetry endpoints (optional)

Sent only when using the Anthropic API directly; never on third-party providers

http-intake.logs.us5.datadoghq.com: Operational telemetry events
browser-intake-us5-datadoghq.com: Operational error reports (gated by a server-side rollout flag)

Environment variables to disable non-essential traffic

Simpler than allowlisting the telemetry hosts if you would rather turn them off at the source

CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1: Disables both Datadog endpoints at once
DISABLE_TELEMETRY=1: Disables telemetry
DO_NOT_TRACK=1: The generic do-not-track standard; same effect
DISABLE_ERROR_REPORTING=1: Disables error reporting

IP / ASN fallback rules

CIDR / ASN rules are a last-resort fallback only, and need periodic re-checking against BGP/ASN changes. Do not treat the examples below as a permanent complete list:

IP-CIDR, 160.79.104.0/21

IP-CIDR6, 2607:6bc0::/32

IP-ASN, AS399358

Additional detail: AS399358 currently announces 160.79.104.0/23 and two IPv6 /48s (2607:6bc0::/48, 2607:6bc0:11::/48) — narrower than the registered blocks. Configuring the registered blocks is broader and safer. Note also that the telemetry and install hosts (Datadog, npm, GitHub, Google Cloud) fall outside Anthropic's own ranges, so IP fallback cannot cover them; only domain rules can.

System time sync

Claude Code's own official network requirements don't include NTP. However, significant system clock drift can cause TLS, OAuth login, and request-signing flows to fail. It's recommended to keep system time accurate; whether to proxy NTP traffic depends on your network environment and client capabilities.

One widespread claim worth correcting: some guides say Claude Code determines your timezone via NTP and that you must therefore proxy NTP. This is impossible at the protocol level — NTP carries only UTC timestamps and has no timezone field; the timezone comes from your OS settings. NTP appears nowhere in the official network requirements either. What actually leaks your timezone is the browser and system Intl / getTimezoneOffset APIs, which proxying NTP does nothing about.

Configuration format example (domain list)

# 核心 (DOMAIN-SUFFIX 已覆盖各自全部子域名)
DOMAIN-SUFFIX,anthropic.com,Claude
DOMAIN-SUFFIX,claude.ai,Claude
DOMAIN-SUFFIX,claude.com,Claude
DOMAIN-SUFFIX,clau.de,Claude
DOMAIN-SUFFIX,claudeusercontent.com,Claude

# 安装 / 插件 / 文档
DOMAIN-SUFFIX,registry.npmjs.org,Claude
DOMAIN,storage.googleapis.com,Claude
DOMAIN,raw.githubusercontent.com,Claude
DOMAIN,formulae.brew.sh,Claude

# 遥测 (可用环境变量关闭; 注意是独立域名, 后缀匹配抓不到)
DOMAIN,http-intake.logs.us5.datadoghq.com,Claude
DOMAIN,browser-intake-us5-datadoghq.com,Claude

# IP / ASN 兜底
IP-CIDR,160.79.104.0/21,Claude,no-resolve
IP-CIDR6,2607:6bc0::/32,Claude,no-resolve
IP-ASN,399358,Claude,no-resolve

Note: DOMAIN-SUFFIX already covers every subdomain, so there is no need to repeat them. The two Datadog intake hosts are separate registrable domains and require exact matches. Add no-resolve to CIDR/ASN rules to skip reverse lookups and cut matching overhead.

Verification

After configuring, use these tools to verify no traffic is leaking through: