Skip to main content
Claude Cowork can export organization-wide OpenTelemetry logs directly to Runlayer. Use this setup when you want Cowork sessions to appear in Runlayer Sessions without installing a local hook or daemon on each user’s machine. Runlayer accepts Cowork logs at:
For manual local payload tests, use the local app URL:
Do not use localhost in Claude Cowork monitoring settings. Cowork exports from Anthropic’s VM, so localhost points at the Cowork environment, not your developer machine. To test with a real Cowork session against a local Runlayer stack, expose your local app through a reachable HTTPS tunnel and use that tunnel URL as the OTLP endpoint.

​
Requirements

  • Claude Team or Enterprise with Cowork monitoring access
  • Claude desktop app version 1.1.4173 or later
  • A Runlayer organization API key with the OTLP Telemetry permission
  • Full session scanning enabled for Claude Cowork in Runlayer

​
Create the Runlayer API key

1

Open Organization API keys

In Runlayer, go to Settings → Organization API keys.
2

Create a scoped key

Click Create Organization API Key, give it a name such as Claude Cowork OTLP, and select OTLP Telemetry. It must be the key’s only permission; Runlayer clears any other selection when you pick it.
3

Copy the key

Copy the generated rl_org_... value. Cowork uses this key in the OTLP header, and Runlayer rejects user API keys or org keys without the OTLP Telemetry permission.
Cowork settings already configured with an existing Shadow AI Scan organization key (hand-created or from a configuration in Settings → MDM configuration) keep working; no re-keying is required. Use OTLP Telemetry for new setups so the key cannot use the AI Watch scan and hook endpoints.
The key is organization-wide and user-agnostic by design: Cowork exports from its VM on behalf of every user, and Runlayer attributes sessions to users from the telemetry itself. Organization API keys do not expire, and this one can only write OTLP data, so the blast radius of a leak is limited to injecting telemetry. Rotate it if you suspect exposure.

​
Rotate the key

1

Create the replacement

In Settings → Organization API keys, create a new key with only the OTLP Telemetry permission and copy the rl_org_... value.
2

Update Cowork

In Claude admin settings, replace the OTLP headers value with Authorization=Bearer <new key>.
3

Revoke the old key

Back in Organization API keys, revoke the previous key. Exports still using it start receiving 401 responses immediately.

​
Enable Cowork in Runlayer

1

Open Full session scanning

In Runlayer, go to Settings → Agent session monitoring.
2

Enable the API

Turn on Full session scanning APIs.
3

Enable Claude Cowork

Under Hook clients, turn on Claude Cowork, then save the settings.

​
Configure Claude Cowork

In Claude admin settings, open Cowork monitoring settings and set: If your organization restricts Cowork network egress, allowlist your Runlayer tenant hostname, such as <your-tenant>.runlayer.com. Cowork exports telemetry from its VM, so blocked egress prevents events from reaching Runlayer. After saving the Cowork monitoring settings, start a new Cowork session. Cowork loads monitoring settings when a session starts, so already-running sessions do not pick up the new OTLP destination.

​
Verify in Runlayer

  1. Start a new Cowork session and submit a prompt.
  2. Open Sessions in Runlayer.
  3. Filter by client Claude Cowork.
You should see Cowork prompts, tool decisions, tool results, API requests, and API errors in the session timeline. Runlayer closes Cowork sessions automatically after they stop sending activity.

​
Troubleshooting

  • Confirm Full session scanning APIs is on.
  • Confirm Claude Cowork is enabled under Hook clients.
  • Confirm the Cowork OTLP endpoint includes /api/v1/hooks/cowork/otlp/v1/logs.
  • Confirm the OTLP header uses an organization API key with OTLP Telemetry.
  • Start a new Cowork session after changing monitoring settings.
  • If Cowork egress allowlisting is enabled, allowlist your Runlayer tenant hostname.
Use an organization API key whose only permission is OTLP Telemetry (or any existing Shadow AI Scan organization key, hand-created or from an MDM configuration). Personal user API keys, org keys without either role, and OTLP Telemetry keys that carry other permissions are rejected for Cowork OTLP ingestion.
Use http/protobuf for normal deployments. Use http/json when you need to inspect payloads while testing. Runlayer accepts both protocols on the same endpoint.