Route Claude CLI traffic through Kong AI Gateway and DashScope
Install Claude CLI, configure its API key helper, create a Gateway Service and Route, attach the AI Proxy plugin to forward requests to DashScope, enable file-log to inspect traffic, and point Claude CLI to the local proxy endpoint so all LLM requests pass through the AI Gateway for monitoring and control.
Prerequisites
Kong Konnect
This is a Konnect tutorial and requires a Konnect personal access token.
-
Create a new personal access token by opening the Konnect PAT page and selecting Generate Token.
-
Export your token to an environment variable:
export KONNECT_TOKEN='YOUR_KONNECT_PAT'Copied! -
Run the quickstart script to automatically provision a Control Plane and Data Plane, and configure your environment:
curl -Ls https://get.konghq.com/quickstart | bash -s -- -k $KONNECT_TOKEN --deck-outputCopied!This sets up a Konnect Control Plane named
quickstart, provisions a local Data Plane, and prints out the following environment variable exports:export DECK_KONNECT_TOKEN=$KONNECT_TOKEN export DECK_KONNECT_CONTROL_PLANE_NAME=quickstart export KONNECT_CONTROL_PLANE_URL=https://us.api.konghq.com export KONNECT_PROXY_URL='http://localhost:8000'Copied!Copy and paste these into your terminal to configure your session.
Kong Gateway running
This tutorial requires Kong Gateway Enterprise. If you don’t have Kong Gateway set up yet, you can use the quickstart script with an enterprise license to get an instance of Kong Gateway running almost instantly.
-
Export your license to an environment variable:
export KONG_LICENSE_DATA='LICENSE-CONTENTS-GO-HERE'Copied! -
Run the quickstart script:
curl -Ls https://get.konghq.com/quickstart | bash -s -- -e KONG_LICENSE_DATACopied!Once Kong Gateway is ready, you will see the following message:
Kong Gateway Ready
decK v1.43+
decK is a CLI tool for managing Kong Gateway declaratively with state files. To complete this tutorial, install decK version 1.43 or later.
This guide uses deck gateway apply, which directly applies entity configuration to your Gateway instance.
We recommend upgrading your decK installation to take advantage of this tool.
You can check your current decK version with deck version.
Required entities
For this tutorial, you’ll need Kong Gateway entities, like Gateway Services and Routes, pre-configured. These entities are essential for Kong Gateway to function but installing them isn’t the focus of this guide. Follow these steps to pre-configure them:
-
Run the following command:
echo ' _format_version: "3.0" services: - name: example-service url: http://httpbin.konghq.com/anything routes: - name: example-route paths: - "/anything" service: name: example-service ' | deck gateway apply -Copied!
To learn more about entities, you can read our entities documentation.
DashScope
You need an active DashScope account with API access. Sign up at the Alibaba Cloud DashScope platform, obtain your API key from the API-KEY interface, and export it to your environment:
export DECK_DASHSCOPE_API_KEY='YOUR DASHSCOPE API KEY'
Claude Code CLI
-
Install Claude:
curl -fsSL https://claude.ai/install.sh | bashCopied! -
Create or edit the Claude settings file:
mkdir -p ~/.claude nano ~/.claude/settings.jsonCopied!Put this exact content in the file:
{ "apiKeyHelper": "~/.claude/anthropic_key.sh" }Copied! -
Create the API key helper script:
nano ~/.claude/anthropic_key.shCopied!Inside, put a dummy API key:
echo "x"Copied! -
Make the script executable:
chmod +x ~/.claude/anthropic_key.shCopied! -
Verify it works by running the script:
~/.claude/anthropic_key.shCopied!You should see only your API key printed.
Configure the AI Proxy plugin
Configure the AI Proxy plugin for the DashScope provider.
- This setup uses the default
llm/v1/chatroute. Claude Code sends its requests to this route. - The configuration also raises the maximum token count size to 8192 to support larger prompts.
The llm_format: anthropic parameter tells Kong AI Gateway to expect request and response payloads that match Claude’s native API format. Without this setting, the gateway would default to OpenAI’s format, which would cause request failures when Claude Code communicates with the DashScope endpoint.
echo '
_format_version: "3.0"
plugins:
- name: ai-proxy
config:
llm_format: anthropic
route_type: llm/v1/chat
logging:
log_statistics: true
log_payloads: false
auth:
header_name: Authorization
header_value: Bearer ${{ env "DECK_DASHSCOPE_API_KEY" }}
model:
provider: dashscope
name: qwen-plus
options:
max_tokens: 8192
temperature: 1.0
' | deck gateway apply -
Configure the File Log plugin
Enable the File Log plugin on the service to inspect the LLM traffic between Claude and the AI Gateway. This creates a local claude.json file on your machine. The file records each request and response so you can review what Claude sends through the AI Gateway.
echo '
_format_version: "3.0"
plugins:
- name: file-log
config:
path: "/tmp/claude.json"
' | deck gateway apply -
Verify traffic through Kong
Start a Claude Code session that points to the local AI Gateway endpoint:
Ensure that
ANTHROPIC_MODELmatches the model you configured in the AI Proxy plugin (for example,qwen-plus).
ANTHROPIC_BASE_URL=http://localhost:8000/anything \
ANTHROPIC_MODEL=qwen-plus \
claude
Claude Code asks for permission before it runs tools or interacts with files:
I'll need permission to work with your files.
This means I can:
- Read any file in this folder
- Create, edit, or delete files
- Run commands (like npm, git, tests, ls, rm)
- Use tools defined in .mcp.json
Learn more ( https://docs.claude.com/s/claude-code-security )
❯ 1. Yes, continue
2. No, exit
Select Yes, continue. The session starts. Ask a simple question to confirm that requests reach Kong AI Gateway.
Tell me who Niketas Choniates was.
Claude Code might prompt you to approve its web search for answering the question. When you select Yes, Claude will produce a full-length response to your request:
Niketas Choniates was a Byzantine Greek historian and government official
who lived from around 1155 to 1217. He is best known for his historical
work "Historia" (also called "Chronike Diegesis"), which chronicles the
reigns of the Byzantine emperors from 1118 to 1207, covering the period of
the Komnenos and Angelos dynasties.
Choniates served as a high-ranking official in the Byzantine Empire,
eventually becoming the governor of Athens. His historical writings are
particularly valuable because they provide a detailed eyewitness account
of the Fourth Crusade and the subsequent sack of Constantinople in 1204,
an event he personally experienced and fled from. His account is
considered one of the most important sources for understanding this
pivotal moment in Byzantine history.
Next, inspect the Kong AI Gateway logs to verify that the traffic was proxied through it:
docker exec kong-quickstart-gateway cat /tmp/claude.json | jq
You should find an entry that shows the upstream request made by Claude Code. A typical log record looks like this:
{
...
"upstream_uri": "/compatible-mode/v1/chat/completions?beta=true",
"request": {
"method": "POST",
"headers": {
"user-agent": "claude-cli/2.0.57 (external, cli)",
"content-type": "application/json",
"anthropic-version": "2023-06-01"
}
},
...
"ai": {
"proxy": {
"usage": {
"completion_tokens": 493,
"completion_tokens_details": {},
"total_tokens": 13979,
"cost": 0,
"time_per_token": 34.539553752535,
"time_to_first_token": 17027,
"prompt_tokens": 13486,
"prompt_tokens_details": {
"cached_tokens": 0
}
},
"meta": {
"response_model": "qwen-plus",
"plugin_id": "63199335-6c5a-4798-a0ad-f2cbf13cc497",
"request_model": "qwen-plus",
"request_mode": "oneshot",
"provider_name": "dashscope",
"llm_latency": 17028
}
}
},
"response": {
"headers": {
"x-kong-llm-model": "dashscope/qwen-plus",
"x-dashscope-call-gateway": "true"
}
}
...
}
This output confirms that Claude Code routed the request through Kong AI Gateway using DashScope with the qwen-plus model.
Cleanup
Clean up Konnect environment
If you created a new control plane and want to conserve your free trial credits or avoid unnecessary charges, delete the new control plane used in this tutorial.
Destroy the Kong Gateway container
curl -Ls https://get.konghq.com/quickstart | bash -s -- -d