Add support for ANTHROPIC_API_KEY environment variable authentication detection

[menny]

Summary

This PR enhances Claude authentication detection to support both the ANTHROPIC_API_KEY environment variable and the OAuth credentials file, matching the authentication priority order used by the Claude Agent SDK.

Changes

Modified Files

• server/routes/cli-auth.js

Key Updates

1. Updated checkClaudeCredentials() function to check ANTHROPIC_API_KEY environment variable first, then fall back to ~/.claude/.credentials.json OAuth tokens

2. Modified /api/cli-auth/claude/status endpoint to return authentication method indicator:

   • method: 'api_key' when using ANTHROPIC_API_KEY environment variable
   • method: 'credentials_file' when using OAuth credentials file
   • method: null when not authenticated

3. Added comprehensive documentation with JSDoc comments explaining:

   • Authentication priority order
   • SDK behavior consistency
   • References to official Claude documentation

Authentication Priority Order

1. ANTHROPIC_API_KEY environment variable (highest priority)
2. ~/.claude/.credentials.json OAuth tokens (fallback)

This priority order matches the Claude Agent SDK's authentication behavior, ensuring consistency between how we detect authentication and how the SDK actually authenticates.

API Response Format

The /api/cli-auth/claude/status endpoint now returns:

{
  "authenticated": true,
  "email": "[email protected]",
  "method": "credentials_file"
}

Or when using API key:

{
  "authenticated": true,
  "email": "API Key Auth",
  "method": "api_key"
}

Backward Compatibility

✅ Fully backward compatible - existing code checking the authenticated field will continue to work as expected.

Important Note

⚠️ When ANTHROPIC_API_KEY is set, API calls are charged via pay-as-you-go rates instead of subscription rates, even if the user is logged in with a claude.ai subscription.

References

• Managing API key environment variables in Claude Code

  • "Claude Code prioritizes environment variable API keys over authenticated subscriptions"

• Agent SDK Overview

  • Official Claude Agent SDK authentication documentation

Testing

The implementation has been verified to:

• ✅ Check ANTHROPIC_API_KEY environment variable first
• ✅ Fall back to credentials file when env var is not set
• ✅ Return correct authentication method in API response
• ✅ Maintain backward compatibility with existing API consumers

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Added support for ANTHROPIC_API_KEY environment variable for authentication, prioritized over stored OAuth tokens
  • Enhanced authentication status endpoint to report which authentication method is in use (environment variable or credentials file)

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Walkthrough

The Claude authentication flow is extended to check the ANTHROPIC_API_KEY environment variable as the primary credential source, falling back to OAuth tokens from ~/.claude/.credentials.json. All /claude/status responses and error paths now include a method field indicating which authentication approach was used: 'api_key', 'credentials_file', or null when unauthenticated.

Changes

Cohort / File(s)	Summary
Authentication Method Prioritization server/routes/cli-auth.js	Added internal checkClaudeCredentials() function that prioritizes ANTHROPIC_API_KEY environment variable over OAuth tokens; returns { authenticated, email, method } with method indicating 'api_key', 'credentials_file', or null. Updated /claude/status endpoint to surface method in successful responses and error paths; modified all response branches to include method field for consistency.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 A key from the sky, or a file down below,
Auth methods now dance in a priority flow,
First comes the env var, so speedy and bright,
Then credentials file as the fallback in sight,
Status reports now reveal which took flight! 🔐✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: adding ANTHROPIC_API_KEY environment variable authentication support to the Claude authentication flow.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[menny]