[FEATURE] Allow other login methods alongside a Claude apps gateway enrolment, for consultants working across several clients on one laptop

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

Enrolling a machine in a self-hosted Claude apps gateway takes over every Claude Code session on it. Per the authentication docs, when managed settings set forceLoginMethod: "gateway" or forceLoginGatewayUrl, "your session uses only the gateway sign-in. Claude Code skips the other credential sources", and /login opens straight to the Cloud gateway screen. Managed settings are machine-wide, and CLAUDE_CONFIG_DIR separates credentials but not managed settings, so there is no way to keep the gateway lock to one context.

That breaks a common consulting setup. A consultant works for several clients from one laptop, often one their own firm supplies. Client A runs a Claude apps gateway and enrols the laptop. Client B, or the consultant's own firm, uses a claude.ai subscription. Once Client A's enrolment is in place, the Client B work can't run at all. The only ways out are to remove the machine-wide managed-settings file (which needs admin rights, undoes Client A's enrolment, and has to be redone for every switch) or to keep one client's work in a VM.

Client A's admins can't solve this for them. The gateway's IdP already controls who can reach Client A's gateway, and forceLoginOrgUUID doesn't apply to gateway sign-in. What locks the laptop is the machine-wide managed file, not anything the client needs.

Proposed Solution

Let a gateway enrolment coexist with other login methods, scoped by config directory. Either of these would do:

1. A managed setting that offers the gateway without forcing it, e.g. forceLoginGatewayUrl with a companion like gatewayLoginRequired: false. /login would list Cloud gateway alongside the stock methods, and a session in a config directory signed in some other way keeps using that login.
2. Scope gateway enforcement to the config directory that signed in to the gateway. Sessions using a different CLAUDE_CONFIG_DIR, and so a different Keychain entry, would follow their own login. That gives CLAUDE_CONFIG_DIR=~/.claude-client-b claude a clean separation.

In both cases a gateway session would still get its policy from the gateway, as it does today. Only sessions not signed in to the gateway would be unaffected.

Alternative Solutions

• Remove the managed-settings file before Client B work and restore it afterwards. This needs sudo each time and is error-prone.
• Run one client's work in a VM or dev container, which has its own managed-settings path. This works, but adds heavy setup for something that could be a login choice.
• CLAUDE_CODE_USE_BEDROCK / CLAUDE_CODE_USE_VERTEX bypass the gateway per session, but only help when the other client uses a cloud provider, not a claude.ai subscription.

Priority

High - Significant impact on productivity

Feature Category

Configuration and settings

Use Case Example

1. A consultant's laptop is enrolled in Client A's gateway by Client A's installer or MDM profile: forceLoginMethod: "gateway" and forceLoginGatewayUrl in /Library/Application Support/ClaudeCode/managed-settings.json.
2. For Client A work, they run claude and sign in through the gateway, as today.
3. For Client B work, they run CLAUDE_CONFIG_DIR=~/.claude-client-b claude and /login with Client B's claude.ai subscription.
4. Expected: Client B sessions use the subscription while Client A sessions stay on the gateway. Actual: /login only offers Cloud gateway, and the subscription login is ignored.

Additional Context

• Claude Code 2.1.281, macOS. Observed: /login shows only the Cloud gateway option whether or not the user is signed in.
• 2.1.261 and 2.1.265 made gateway enrolment stricter (leftover claude.ai logins and forceLoginGatewayUrl alone both lead to gateway-only sessions). This request is not to undo that for single-tenant machines, only to allow an explicit opt-in for multi-client ones.
• Related multi-account requests for claude.ai logins: #30031, #22872. Neither covers the gateway case.