Claude Code Setup Guide

Send the prompts your developers submit in Claude Code to Axia, so sensitive data pasted into an AI coding agent is detected.

What you'll have at the end

A Claude Code hook on each developer machine that forwards every submitted prompt to Axia, using the Webhook URL and Webhook Secret you get on the Connect page in Axia.

Prerequisites

Developer machines on macOS, Linux or Windows, with Python 3 on the PATH as python3 or python (standard library only, nothing to install)
On Windows: Git for Windows. Claude Code runs hooks with its Git Bash; without it, the hook does not run.
Developer machines can reach your Axia Webhook URL over HTTPS (directly, or through your VPN)
For a fleet rollout: an MDM or configuration management tool (Jamf, Kandji, Intune, Ansible…) that can place a file on each machine, or a Claude for Teams or Enterprise plan to deploy from the Claude admin console

Tell your developers

Capturing prompts is monitoring of what employees type. Treat it as a policy and consent matter, and tell developers before you turn it on.

1 Connect Claude Code in Axia

In Axia, open Connect and find Claude Code under AI coding.
Click Connect.
Axia shows a Webhook URL and a Webhook Secret. Copy both.

Value to copy	Looks like
Webhook URL	`https://<your-axia-host>/api/v1/webhooks/claude_code`
Webhook Secret	A long random string

The secret is shown once

Save the Webhook Secret in your password manager now. If you lose it, open the connection on the Connect page and click Regenerate secret, then update every machine: the old secret stops working.

2 Check the Webhook URL is reachable

From a developer machine, send a test prompt. Replace the two values with yours:

curl -i -X POST "https://<your-axia-host>/api/v1/webhooks/claude_code" \
  -H "Content-Type: application/json" \
  -H "X-Webhook-Secret: <webhook-secret>" \
  -d '{"event":"user_prompt_submit","timestamp":"2026-01-01T00:00:00Z","project_dir":"/tmp",
       "data":{"user_prompt":"Axia connectivity test","session_id":"setup-test","prompt_id":"1","user":"you@yourcompany.com"}}'

You should get HTTP 202 with "status":"accepted". If not, see Troubleshooting.

3 Deploy the hook

All three options below use the same settings. Copy them and replace the two placeholder values with the ones from step 1:

{
  "env": {
    "AXIA_WEBHOOK_URL": "https://<your-axia-host>/api/v1/webhooks/claude_code",
    "AXIA_WEBHOOK_SECRET": "<webhook-secret>"
  },
  "hooks": {
    "UserPromptSubmit": [
      {
        "hooks": [
          {
            "type": "command",
            "timeout": 10,
            "command": "for p in python3 python; do $p -V >/dev/null 2>&1 && break; done; $p -c \"import os,sys,json,shutil,subprocess,getpass,datetime as dt;s=os.environ.get('AXIA_WEBHOOK_SECRET','');url=os.environ.get('AXIA_WEBHOOK_URL','');(s and url) or sys.exit(0);d=json.load(sys.stdin);e=(subprocess.run(['git','config','user.email'],capture_output=True,text=True).stdout.strip() if shutil.which('git') else '');u=os.environ.get('AXIA_USER_EMAIL') or e or getpass.getuser();body=json.dumps({'event':'user_prompt_submit','timestamp':dt.datetime.now(dt.timezone.utc).isoformat(),'project_dir':d.get('cwd',''),'data':{'user_prompt':d.get('prompt',''),'session_id':d.get('session_id',''),'prompt_id':d.get('prompt_id',''),'user':u}});p=subprocess.Popen([sys.executable,'-c','import sys,json,urllib.request as r;m=json.loads(sys.stdin.buffer.readline());r.urlopen(r.Request(m[0],data=sys.stdin.buffer.read(),headers=m[1]),timeout=5)'],stdin=subprocess.PIPE,stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,**({'creationflags':0x00000208} if os.name=='nt' else {'start_new_session':True}));p.stdin.write(json.dumps([url,{'Content-Type':'application/json','X-Webhook-Secret':s}]).encode()+bytes([10])+body.encode());p.stdin.close()\" 2>/dev/null || true"
          }
        ]
      }
    ]
  }
}

Use the Claude admin console or MDM option for production: developers cannot remove or override them. Use the per-user option to try it on your own machine first.

Option A — Claude admin console (recommended)

For Claude for Teams and Claude for Enterprise. Claude delivers the settings to every developer who signs in to Claude Code with your organization's account, with no file to deploy.

Open Claude managed settings ↗

Sign in to claude.ai as an Owner or Primary Owner of your Claude organization.
Go to Organization settings > Claude Code > Managed settings (the button above opens it).
Paste the settings above, or merge the env and hooks keys into the settings already there, and save.

Good to know

Developers see a one-time security prompt asking them to approve the hook. Settings from the console only reach sessions signed in with your Claude Teams or Enterprise account. Sessions that use a Claude Console API key, Amazon Bedrock or Google Vertex AI don't receive them: use Option B for those machines.

Option B — Managed settings file (MDM)

Push the settings as a file with your MDM. Claude Code reads it on every machine and it takes precedence over user and project settings. If the file already exists, merge the env and hooks keys into it.

OS	Path
macOS	`/Library/Application Support/ClaudeCode/managed-settings.json`
Linux	`/etc/claude-code/managed-settings.json`
Windows	`C:\Program Files\ClaudeCode\managed-settings.json`

Protect the file

The file holds the Webhook Secret. Make it owned by root and not writable by users (for example chown root:wheel and chmod 644 on macOS; on Windows, only Administrators can write to C:\Program Files). The secret only lets a machine send prompts to Axia; it cannot read anything.

Option C — Per-user (for testing)

Merge the settings into ~/.claude/settings.json on your machine.
Restart Claude Code. Run /hooks in Claude Code to check that UserPromptSubmit lists the hook.

A developer can edit or remove this file, so don't rely on it for monitoring.

Which user is the prompt attributed to?

Claude Code does not tell hooks who the user is, so the hook works it out in this order:

The AXIA_USER_EMAIL environment variable, if set
The developer's git config user.email
The operating system login name

For reliable attribution, set AXIA_USER_EMAIL per user through your MDM, or make sure developers' git email is their work email. The same order is used for Cursor, so one person's Claude Code and Cursor prompts match up.

4 Verify

On a machine with the hook, start Claude Code and send any prompt.
In Axia, the Claude Code connection on the Connect page shows a recent event. A prompt containing test sensitive data (for example a fake card number) should open a case.

Troubleshooting

Symptom	Cause	Fix
Test returns `404` Unknown source	Claude Code is not connected in Axia, or the URL is wrong	Connect Claude Code (step 1) and copy the Webhook URL exactly
Test returns `401`	Wrong or missing secret	Paste the secret again, or regenerate it on the Connect page and update every machine
Test times out	The machine can't reach Axia	Check VPN, proxy and firewall rules for the Axia host
Test works, but no prompts arrive	The hook isn't loaded, or the variables are empty	Run `/hooks` in Claude Code; check the `env` block; check `python3 --version` (Windows: `python --version`) works in a terminal
No prompts arrive from Windows machines	Git for Windows is missing, so Claude Code runs the hook in PowerShell	Install Git for Windows, or set `CLAUDE_CODE_GIT_BASH_PATH` if it is installed somewhere Claude Code doesn't find
Prompts are attributed to a login name, not an email	No `AXIA_USER_EMAIL` and no git email	Set `AXIA_USER_EMAIL` or the developer's git email

Verification Checklist

Claude Code connected on the Axia Connect page
Webhook URL and Webhook Secret saved in your password manager
Test curl from a developer machine returns 202
Developers informed that prompts are monitored
Settings deployed from the Claude admin console, or as a managed settings file by MDM (owned by root)
AXIA_USER_EMAIL set, or developers' git email is their work email
A test prompt shows up in Axia