Agentic Data Plane

Use Claude Code with Redpanda ADP

Claude Code is Anthropic’s command-line coding agent. When you point it at an AI Gateway proxy URL instead of the public Anthropic API, your team’s LLM calls flow through ADP: API keys stay in the dataplane secret store, usage rolls up on the Cost & Usage page, and the calls land in the Transcripts view for investigation.

After completing this guide, you will be able to:

  • Configure Claude Code to call an Anthropic provider hosted in ADP instead of the public Anthropic API

  • Attach ADP-hosted MCP servers to Claude Code so its tools resolve against your managed tool catalog

  • Verify the connection and read usage

When to use ADP with Claude Code

Use this integration when you want to:

  • Pull Anthropic API keys out of every developer’s shell and manage them centrally.

  • Track Claude Code spend per provider, model, and user without parsing each developer’s individual Anthropic invoice.

  • Apply per-provider transcript logging. For example, route a regulated team to a "no-logging" provider while keeping the default provider’s full conversation history available for review.

  • Forward each developer’s own Anthropic subscription token through ADP (Anthropic Authorization passthrough), so the existing Max- or Team-plan entitlement still applies but the call is observed by ADP.

This guide does not cover building agents that call Claude Code. For that, see Integration patterns overview.

Prerequisites

  • An Anthropic LLM provider configured in ADP. If you haven’t created one, follow Configure an LLM provider and pick Anthropic as the type. Enable at least one Claude model (for example, claude-sonnet-4-6 or claude-opus-4-7) in the model picker.

  • Claude Code installed on the developer’s workstation. See Anthropic’s Claude Code documentation.

  • A Redpanda service account with permission to invoke the provider (dataplane_adp_llmprovider_invoke). See LLM provider permissions. Both shared-developer-tooling and per-developer setups use the same OIDC client-credentials grant; the differences are operational.

Get the proxy URL

  1. Open LLM Providers in the sidebar.

  2. Click into your Anthropic provider.

  3. On the Connection card, copy the Proxy URL. It looks like:

    https://aigw.<cluster-id>.clusters.rdpa.co/llm/v1/providers/<provider-name>

    The provider’s Connect tab also generates a ready-to-paste Claude Code configuration (environment variables or a settings-file snippet) pre-filled with this URL: pick Claude Code from the client dropdown. Use it instead of hand-editing if you want to skip the next section.

Configure Claude Code

Claude Code reads the Anthropic base URL and an authentication token from environment variables. Set both to point at the ADP proxy URL.

  • OIDC service account (default)

  • Anthropic Authorization passthrough

Use the OIDC client_credentials grant to mint an access token, then hand the token to Claude Code through ANTHROPIC_AUTH_TOKEN. This is the same flow Connect your app to AI Gateway documents for SDK clients; the only thing different here is how Claude Code reads the token.

  1. Mint an access token. The full cURL, Python, and Node.js examples live in Authenticate with OIDC client credentials. The short version:

    ANTHROPIC_AUTH_TOKEN=$(curl -s --request POST \
    --url 'https://auth.prd.cloud.redpanda.com/oauth/token' \
    --header 'content-type: application/x-www-form-urlencoded' \
    --data grant_type=client_credentials \
    --data client_id=<client-id> \
    --data client_secret=<client-secret> \
    --data audience=cloudv2-production.redpanda.cloud | jq -r .access_token)
export ANTHROPIC_AUTH_TOKEN

  2. Export the proxy URL:

    export ANTHROPIC_BASE_URL="https://aigw.<cluster-id>.clusters.rdpa.co/llm/v1/providers/<provider-name>"

  3. Launch Claude Code as you normally would. Calls flow through ADP.

The token has a short TTL: re-mint when it expires. AI Gateway does not refresh OIDC tokens for you. For day-to-day work, wrap the mint-and-export in a shell function or sub-shell so you don’t have to remember the steps.

Use when developers authenticate to Anthropic with their own subscription (Max plan, Team plan, enterprise) and ADP only observes the call.

  1. Confirm the provider has Authorization passthrough enabled. The Connection card on the provider detail page shows the current setting as Auth passthrough. If it is off, an admin needs to flip it. See Anthropic: Authorization passthrough.

  2. Set the base URL but pass the developer’s own Anthropic key as the token:

    export ANTHROPIC_BASE_URL="https://aigw.<cluster-id>.clusters.rdpa.co/llm/v1/providers/<provider-name>"
export ANTHROPIC_AUTH_TOKEN="<your-anthropic-api-key-or-subscription-token>"

AI Gateway forwards the Authorization header to Anthropic unchanged. Usage is still recorded against the provider on the Cost & Usage page; the upstream subscription bears the cost.

The model identifier Claude Code sends (for example, claude-sonnet-4-6) must be one your Anthropic provider exposes. If you see a "model not found" error, open the provider detail page, confirm the model is ticked in the catalog, and pass the exact identifier shown there.

Attach ADP-hosted MCP servers (optional)

Claude Code can call MCP servers for tool access. To use the MCP servers you already host in ADP (managed catalog types, self-managed proxied servers, or both), register each one with Claude Code’s MCP configuration:

claude mcp add <server-name> https://aigw.<cluster-id>.clusters.rdpa.co/mcp/v1/<server-name>

For OAuth-protected MCP servers (most managed types), Claude Code prompts the developer to complete the consent flow on first use. ADP stores the resulting token in the per-user token vault, so subsequent invocations reuse it.

If a server exposes a large tool catalog, turn on code mode and point Claude Code at the server’s code-mode endpoint to cut the token cost of loading every tool definition.

Verify the connection

  1. Run a short prompt:

    claude "say hello"

  2. Open Cost & Usage under Governance in the sidebar, then filter by your provider. Within a few seconds the request appears in the Requests over time chart.

  3. Open Transcripts to read the full turn (if transcript logging is enabled on this provider).

Troubleshooting

Symptom What to check

401 Unauthorized

Token is missing, malformed, or expired. Re-mint the OIDC access token (it has a short TTL) and re-export ANTHROPIC_AUTH_TOKEN. Confirm the audience is cloudv2-production.redpanda.cloud and that Claude Code is sending the token as Authorization: Bearer <token>. For Authorization passthrough, confirm the upstream Anthropic key is valid.

403 Forbidden

The service account or user lacks dataplane_adp_llmprovider_invoke on the provider. See LLM provider permissions or have an admin assign the LLMProviderInvoker built-in role.

404 Not Found

ANTHROPIC_BASE_URL doesn’t match the provider’s Proxy URL. Copy it again from the Connection card on the detail page; the path segment after /providers/ must be exactly the provider’s Name.

"Model not found"

The model identifier Claude Code is sending is not enabled on the provider. Open the provider detail page, confirm the model row appears, and pass that exact identifier (Claude Code’s --model flag or ANTHROPIC_MODEL env var).

Spend isn’t appearing in Cost & Usage

Allow a few seconds for the cost-reporting pipeline to catch up. If the chart still shows zero after a minute, verify the request actually reached the provider (the Requests over time chart populates first) and that you’re looking at the right date range.

MCP tool calls return OAuthConnectionRequired

The developer hasn’t yet completed the consent flow for that MCP server. See User-delegated OAuth; Claude Code surfaces the authorize_url in the error so the developer can finish the handshake.

Next steps