Appendix: runtime details
- Approved by
- Panaversity ·
What this appendix is for
This appendix holds the technical details behind Cloud environments and self-hosted runners. You do not need them to follow the rest of the section.
Network secrets
| Fact about network secrets | Detail |
|---|---|
| Plans | Pro, Max, Team and Enterprise |
| Who can add one | On Pro and Max, the environment's owner. On Team, any member. Without an admin role, the form takes one secret for one host. On Enterprise, only an organization admin. For a shared environment, an Owner |
| Never attached to | GitHub, the Anthropic API, public package registries, setup script requests and telemetry export |
| Not available | In a self-hosted environment, and for organizations that use customer-managed encryption keys |
| Reachability | The API must accept internet traffic. Requests leave from Anthropic's network |
Basis: vendor-documented.1
The GitHub proxy rejects branch deletions and pushes of anything other than a branch, such as a tag. It does not limit which branches a push can update. For that, Anthropic points to GitHub's branch protection rules.1
How a runner handles a session
[Vendor-documented]2
- Anthropic's control plane, the service that organizes sessions, places the session on the environment's queue.
- A runner with free capacity claims it and holds a lease, a time-limited claim on the session.
- The runner clones the repository and starts a Claude Code process for the session.
- The session streams its events to Anthropic over HTTPS.
- If the runner stops polling, its lease lapses after about 60 seconds. The session goes back to the queue for another runner.
A runner serves one owner at a time. The first session it claims locks it to that owner. So checked-out code never mixes between owners. For Claude Tag channel sessions, the owner is the Claude Tag agent, not a person. Claude Security and Code Review sessions do not route to self-hosted environments yet.2
The self-hosted session token
Every self-hosted session gets a signed token in CLAUDE_CODE_SESSION_ACCESS_TOKEN. It is a JWT, a signed JSON token. Anthropic publishes the keys that check it at a public JWKS (key set) endpoint.3
| The token | Detail |
|---|---|
| Proves | Anthropic issued it for one session in one environment. It also shows who created the session. user: in act.sub means a person. agent: means your organization's service identity, as in Claude Tag channel sessions |
| Does not prove | Which process presents it. "Any code Claude runs, and any tool or MCP server the session starts, can read and present it" |
| Checks | The sk-ant-cc- prefix, an ES256 signature, issuer ccr, your environment ID (ccpool_...) in the audience, role session_worker, and expiry |
| Lifetime | Four hours by default, eight at most. The runner refreshes it. There is no revocation feed |
Basis: vendor-documented.3
Anthropic says not to treat the token as the creator signing in. Limit any credential you derive from it to what one session needs. Make it expire no later than the token. Log it with the session ID and token ID.3
Sources
- Owner
- Panaversity