Adding Tetrate Agent Router as a third-party inference gateway in Claude Desktop
Claude Desktop runs Cowork and Code through an Agent Router gateway with one inference key and no Claude.ai account. Every request lands in your logs, your budgets, and your model policy.
Roy Prins 
Claude Desktop spreads through a company differently from developer tooling, because it does not look like developer tooling. The Cowork tab runs long tasks against files, folders, and connectors. The Code tab is Claude Code with a window around it. People who would never open a terminal install it in an afternoon, and the platform team finds out when the expense reports arrive.
The default way in is a Claude.ai account per person. That is fine for an individual and a problem for an organization. Inference bills to a subscription tier instead of to a team or a project. Requests never touch the AI gateway that Claude Code, Cursor, and VS Code were already routed through, so Request Logs have a hole exactly where the least technical users sit. And the model on offer is whatever the plan tier includes, not what the project catalog grants.
Claude Desktop ships a third-party inference mode that closes that hole. Point it at a Tetrate Agent Router gateway with a base URL, an inference key, and two headers, and every Cowork and Code request becomes an Anthropic Messages call through the gateway: authenticated with the Agent Router key, billed through Agent Router, and visible in Request Logs next to everything else the organization runs. No Claude.ai account needed. The app says so itself on the welcome screen.
Claude Desktop from claude.ai/download, launched once so its user-data directory exists. An Agent Router gateway and an inference key for it. Optionally the tare CLI, which writes the configuration for you. The step-by-step reference is the Claude Desktop guide in the Agent Router docs.
Gateway mode, not a sign-in
It helps to be precise about what changes. In third-party inference mode, Claude Desktop stops signing a person in to Anthropic and starts presenting a key to the gateway. The Agent Router inference key travels as Authorization: Bearer on every request, the gateway resolves the model and the upstream provider, and the cost is attributed to the key’s project and the person’s team the same way it is for any other client. One configuration covers both the Cowork and Code tabs.
Two consequences follow, and both are worth stating before anyone promises a rollout.
Signing in with Claude.ai bypasses the gateway entirely. The welcome screen keeps an Or sign in with Claude.ai link under the Continue button. Anyone who takes it gets a working Claude Desktop, billed to their subscription, invisible to Request Logs. The configuration is still on disk. It is just not in use.
Claude Desktop runs in gateway mode only. Claude Code supports a passthrough mode that keeps a Claude Max or Pro subscription as the billing path while the gateway routes and observes. Claude Desktop does not. Passing --passthrough to the Desktop integration raises no error and has no effect. Inference is billed through Agent Router, full stop.
How to configure Claude Desktop with Agent Router
The values are the same either way: gateway base URL, inference key, bearer auth, and two custom headers that tag the traffic. What differs is who types them.
Option A: let the tare CLI write it
For a rollout beyond a handful of people, the CLI is the path. Users log in once, run one command, and the tool writes the configuration, validates the key against the gateway, and reports back. A bad paste fails at setup instead of on someone’s first prompt.
Install and authenticate against the management plane. The base URL is the API host of your tenant, not the gateway URL shown in the Console:
curl -fsSL https://tare.tetrate.ai/tools/install.sh | bash
tare api login --base-url https://api.<tenant>.tetrate.aiList the data planes the account can route through, then preview the change. The dry run prints exactly what will be written, with the key masked, and writes nothing:
tare integrate dataplanes
tare integrate claude-cowork --dataplane acme-prod --dry-runDetected Claude Cowork: /Users/you/Library/Application Support/Claude-3p exists
? Select model:
claude-fable-5
claude-fable-5-1
claude-haiku-4-5
claude-opus-4-5
↓ claude-opus-4-6
register Cowork third-party-inference entry "Tetrate AgentRouter":
inferenceProvider = gateway
inferenceCredentialKind = static
inferenceGatewayBaseUrl = https://acme-prod.gateway.example.com
inferenceGatewayApiKey = sk-eyJhb...
inferenceGatewayAuthScheme = bearer
inferenceCustomHeaders = {X-Title: Claude-Cowork, X-Provider: Tetrate AgentRouter}
inferenceModels = [claude-fable-5]
--dry-run: no changes written.The model prompt offers only what the key is entitled to call, which is often narrower than the full catalog. Quit Claude Desktop completely, then run the same command without --dry-run. The CLI registers a provider named Tetrate AgentRouter in the app’s configuration library, marks it active, and checks the key against the gateway before it exits.
Claude Desktop reads that configuration at launch and nowhere else, which is why the quit has to be a real quit. Reopen the app and it lands on a welcome screen that confirms the gateway is in place.
Option B: enter it by hand in the Developer menu
The manual path exists for machines where the CLI cannot run, and for anyone who wants to see the dialog before scripting it. It is also the only path when Claude Desktop has never launched on the machine, because the CLI writes into a directory the app creates on first run.
Developer Mode is reachable from the sign-in screen, before any account exists. On macOS it is in the menu bar; on Windows it is behind the application menu at the top left. In both cases: Help, then Troubleshooting, then Enable Developer Mode…. Confirm, and the app restarts.
After the restart, a Developer menu appears. Open it and select Configure Third-Party Inference….
On the Connection tab, fill in the gateway credentials:
| Field | Value |
|---|---|
| Connection | Gateway, the default |
| Credential kind | Static API key |
| Gateway base URL | The gateway URL for your data plane, scheme and host only, no /v1 |
| Gateway API key | An Agent Router inference key for that data plane |
| Gateway auth scheme | bearer |
| Artifact preview iframe origin | Leave blank |
| Custom inference headers | Add two: X-Title: Claude-Cowork and X-Provider: Tetrate AgentRouter |
Select Test connection. Once it reports success, select Apply Changes, then Save & Restart. The app comes back with a You’re using Gateway card, and the account row at the bottom of the sidebar is labeled Gateway.
Choosing a model
The composer on both tabs shows the active model and its effort level. Selecting the model name lists what the key can call, with the active one checked.
Two details here trip people up. Models are listed by gateway id, claude-fable-5 rather than Claude Fable 5, because the list comes from the gateway and not from Anthropic’s own picker. And the list is filtered twice: once by what the key’s project has been granted, and once by the model allowlist in the Claude Desktop configuration. A model enabled organization-wide still has to be granted to the key’s project before it appears. The tare CLI narrows the allowlist to the single model chosen at setup, so widening it later is a visit to the Configure Third-Party Inference dialog, not a re-run of the command.
That is the model choice moving from a plan tier to a policy. If the marketing project’s catalog holds Sonnet and not Fable, no key in that project offers Fable in this picker, and nobody has to explain why.
How to verify traffic in Request Logs
Send a prompt on either tab, then open the Console, go to Monitoring, and select Request Logs. The request appears as Anthropic Messages traffic against the selected model and the key used for the integration. Expand the entry and open Technical Details, then Request, and the two headers are there:
{
"X-Title": "Claude-Cowork",
"X-Provider": "Tetrate AgentRouter"
}Those headers are what make the desktop app separable from everything else a person runs on the same key. When a team’s spend jumps, the question of whether it came from Cowork sessions or from a coding agent fanning out dozens of calls is answered by a filter, not a meeting.
From there, nothing about Claude Desktop is special. The controls that already govern the rest of the organization’s AI traffic apply unchanged: budgets that alert, cap, or degrade to a cheaper model when a team’s monthly amount is reached, traffic splitting that swaps the model on a key without touching the client, and project catalogs that decide what a key can call at all. We covered how those fit together for exactly this workload in Keeping Marketers Away From Fable.
Before you roll it out
A few constraints are cheaper to know in advance than to discover on a Monday.
- Quit means quit. Claude Desktop reads its configuration library at launch only. Applying a change while the app is running produces a warning from the CLI, and a relaunch without a full quit produces a sign-in screen with no gateway option. Cmd-Q, or File then Quit, then reopen.
- The app has to have run once. The CLI writes into a
Claude-3puser-data directory that Claude Desktop creates on first launch. On a fresh machine, launch the app, close it, then run the command. - The sign-in link is always there. Nothing in the client prevents a user from choosing Claude.ai over the gateway. The signal that someone did is an absence: a working app and no traffic in Request Logs. The fix is to sign out, reopen, and select Continue.
- One configuration is active at a time. The dialog can hold several saved configurations. Where gateway settings are present but not in effect, a different entry is active. Switch it from the configuration selector in the dialog, not from the sign-in screen.
- Fewer models than expected is usually entitlement, not a bug. Discovery returns what the key can call, and the local allowlist narrows it further. Grant the model to the key’s project, then widen the allowlist.
The troubleshooting table in the guide maps each of these symptoms to its fix.
One key, one catalog, one bill
The Claude Desktop rollout that used to mean a subscription per person, invisible traffic, and a model chosen by plan tier now means an Agent Router inference key, every request in Request Logs with a header that names the app, and a model picker that shows exactly what the project catalog grants. Cost lands on a team and a project. Policy set once in the gateway applies to the desktop app without anyone editing the desktop app.
Developers and non-developers alike get Cowork and Code with no account to create. The people accountable for spend, and for what leaves the building, get the desktop app inside the same enforcement point they already run for every other client. The rollout stops being a negotiation between the two.
Frequently asked questions
What is third-party inference in Claude Desktop?
Third-party inference is the Claude Desktop mode that stops signing a person in to Anthropic and starts presenting a key to a gateway you configure. With Tetrate Agent Router, every Cowork and Code request becomes an Anthropic Messages call through the gateway: authenticated with the Agent Router key, billed through Agent Router, and visible in Request Logs. No Claude.ai account is needed.
Can I use Claude Desktop without a Claude.ai account or an Anthropic subscription?
Yes. Claude Desktop’s third-party inference mode sends model requests to a gateway you configure, authenticated with that gateway’s key. With Tetrate Agent Router as the gateway, inference is supplied and billed through Agent Router, and the welcome screen confirms that no Claude.ai account is needed.
Does the Agent Router integration cover both the Cowork and Code tabs in Claude Desktop?
Yes. One third-party inference configuration covers both surfaces. The composer on each tab shows the active gateway model, and requests from both appear in Request Logs tagged with X-Title: Claude-Cowork.
Can I keep a Claude Max or Pro subscription and still route Claude Desktop through the gateway?
No. Claude Desktop runs in gateway mode only, so inference is authenticated with the Agent Router key and billed through Agent Router. Passthrough mode, which keeps a subscription as the billing path while the gateway routes and observes, is available for Claude Code and not for Claude Desktop.
How do I verify Claude Desktop is using the gateway?
Send a prompt on either tab, then open the Console, go to Monitoring, and select Request Logs. The request should appear as Anthropic Messages traffic against the selected model and the key used for the integration. Expand Technical Details, then Request, and confirm the X-Title: Claude-Cowork and X-Provider: Tetrate AgentRouter headers. The sidebar account row should read Gateway. A working app with no log entries means the user took the Claude.ai sign-in link instead of Continue.
Do I need the tare CLI to set this up?
No. The same values can be entered by hand in Claude Desktop under Developer, then Configure Third-Party Inference. The CLI is the recommended path for rollouts because it writes the configuration from the logged-in session and validates the key against the gateway before it finishes.
Why does the model picker show fewer models than my administrator enabled?
The picker lists the gateway catalog filtered to what the key can call, and the model allowlist in the Claude Desktop configuration narrows it further. A model enabled organization-wide still has to be granted to the key’s project. Grant it there, then widen the allowlist in the Configure Third-Party Inference dialog.
How do I tell Claude Desktop traffic apart from Claude Code traffic on the same key?
The integration sends X-Title: Claude-Cowork and X-Provider: Tetrate AgentRouter on every request. Both headers appear in Request Logs under Technical Details, so desktop usage and coding-agent usage stay separable in one view.
Now Available
MCP Catalog with verified first-party servers, profile-based configuration, and OpenInference observability are now generally available in Tetrate Agent Router Service. Start building production AI agents today with $5 free credit.
References
- Claude Desktop — Agent Router guide for third-party inference in Claude Desktop
- Configure coding tools with the tare CLI — shared
tare integrateworkflow, dry runs, and key rotation - Connect Claude Code — managed mode and passthrough mode for the Claude Code CLI
- Keeping Marketers Away From Fable — cost attribution and model controls for Claude Cowork traffic
Roy Prins 
