Using Claude Desktop (Cowork)

Claude Desktop's Cowork mode lets non-technical teammates run agentic tasks. Pointing it at Archestra brings that traffic under the same governance as the rest of your platform: inference is routed through an LLM proxy, and Cowork gets your organization's tools through an MCP gateway. Both are wired up by one configuration profile generated on the Connect page, so no JSON is edited by hand.

What the profile wires up

The downloaded profile carries two independent connections:

• Inference points Claude Desktop at …/v1/anthropic/<proxy-id> instead of Anthropic directly. Spend lands in Costs & Limits, requests are traced in Observability, and proxy policies such as Dual LLM apply.
• Tools register the gateway as a managed MCP server named archestra-mcp-<gateway-slug> at …/v1/mcp/<gateway-slug>. It uses OAuth (dynamic client registration), so the gateway authenticates and attributes every tool call as the signed-in user - see MCP Authentication. This part is optional: with no gateway selected the profile is inference-only.

It also embeds two virtual keys, which is why the profile is generated rather than typed in:

• The Gateway API key is a standard virtual key minted from your Anthropic provider key. The proxy swaps it for the real provider key server-side, so the raw Anthropic key never reaches the desktop.
• The X-Archestra-Virtual-Key custom header carries your personal passthrough virtual key. It attributes every request to your user, which is what drives per-user cost, limits, and policies. A second custom header, X-Archestra-Agent-Id, labels the traffic as Claude Desktop in the LLM logs.

Repeat downloads reuse the same two keys (Connection setup - <email> and Connection passthrough - <email>). Revoke them any time on the Virtual Keys page (LLM Proxies → Credentials).

Prerequisites

• An LLM proxy you can access, with an Anthropic provider key configured.
• Permission to create virtual keys (llmVirtualKey:create). Without it, ask an admin either to grant it or to mint the two keys for you on the Virtual Keys page - a profile downloaded by the admin themselves would attribute your traffic to the admin.
• Optional: an MCP gateway to expose tools.
• Claude Desktop with Cowork.

1. Download the profile

On the Connect page choose Claude Desktop, confirm the selections under Review the setup, then click Download configuration. The file holds your keys in plain text, so treat it like a secret; Preview configuration shows the same JSON with secrets masked.

2. Enable Developer Mode

In Claude Desktop, open the menu and choose Help → Troubleshooting → Enable Developer Mode. This adds the Developer menu used next.

3. Import the configuration

Choose Developer → Configure Third-Party Inference….

In the window that opens, click the Default dropdown in the top-right corner, choose Import configuration…, and select the downloaded archestra_con_* file.

4. Test the connection

The import fills the Connection form: provider Gateway, the base URL, the Gateway API key, and both custom headers. Click Test connection - a green result confirms model discovery and a one-token completion through the proxy.

Under Connectors & extensions, the same import added the gateway as a managed MCP server.

5. Apply and relaunch

Click Apply Changes, then Relaunch now.

After the restart the account indicator in the bottom-left reads Gateway - inference is now flowing through Archestra.

6. Connect the MCP gateway

The managed server is imported but not yet authorized. Open Settings from the account menu in the bottom-left, go to Connectors, select the new archestra-mcp-* connector, and click Connect.

Claude Desktop opens your browser on Archestra's consent screen. Click Allow to grant the mcp and offline_access scopes.

The connector then lists the gateway's tools with per-tool approval controls, all defaulting to Needs approval. These can be relaxed here - the gateway still enforces your Archestra permissions on every call.

Done

Start a Cowork task. Inference runs through your proxy and tool calls go through the gateway under your Archestra identity - billed, traced, and policy-checked along the way.