Bug: API Key mode prompts for OAuth login when starting chat

[minty1202]

Description

When using "Anthropic API Key" billing method, the app prompts for OAuth login when attempting to start a chat, instead of using the provided API key.

Steps to Reproduce

1. Launch the app
2. Select "Anthropic API Key" on the billing method screen
3. Enter a valid API key (sk-ant-...)
4. Select a project folder
5. Try to start a chat

Expected Behavior

The chat should work using the provided API key without prompting for OAuth.

Actual Behavior

The app prompts for OAuth login, ignoring the API key that was entered.

Root Cause

Environment variable name mismatch in src/main/lib/trpc/routers/claude.ts:

• Line 981: API key is added as ANTHROPIC_AUTH_TOKEN
• Line 1171: Code checks for ANTHROPIC_API_KEY

// Line 979-986: API key added as ANTHROPIC_AUTH_TOKEN
const claudeEnv = buildClaudeEnv({
  ...(finalCustomConfig && {
    customEnv: {
      ANTHROPIC_AUTH_TOKEN: finalCustomConfig.token,  // Wrong variable name
      ANTHROPIC_BASE_URL: finalCustomConfig.baseUrl,
    },
  }),
  enableTasks: input.enableTasks ?? true,
})

// Line 1170-1172: Checking for ANTHROPIC_API_KEY
const hasExistingApiConfig = !!(
  claudeEnv.ANTHROPIC_API_KEY || claudeEnv.ANTHROPIC_BASE_URL  // Different variable name
)

Proposed Fix

Change ANTHROPIC_AUTH_TOKEN to ANTHROPIC_API_KEY on line 981:

  const claudeEnv = buildClaudeEnv({
    ...(finalCustomConfig && {
      customEnv: {
-       ANTHROPIC_AUTH_TOKEN: finalCustomConfig.token,
+       ANTHROPIC_API_KEY: finalCustomConfig.token,
        ANTHROPIC_BASE_URL: finalCustomConfig.baseUrl,
      },
    }),
    enableTasks: input.enableTasks ?? true,
  })

Environment

• macOS: 14.6.0 (Darwin 24.6.0)
• App version: 0.0.60-beta.4
• Mode: Development (bun run dev)

Additional Notes

This appears to be introduced when API key support was added. The Claude CLI expects ANTHROPIC_API_KEY, not ANTHROPIC_AUTH_TOKEN.

[1code-async]

Task completed.

The comment has been posted to GitHub issue #165. Here's a summary of the analysis:

Bug confirmed: Environment variable name mismatch in src/main/lib/trpc/routers/claude.ts. The API key is set as ANTHROPIC_AUTH_TOKEN (line 981) but checked as ANTHROPIC_API_KEY (line 1171), so the guard hasExistingApiConfig always evaluates to false, causing the app to fall through to OAuth.

Fix: Single-line change — rename ANTHROPIC_AUTH_TOKEN to ANTHROPIC_API_KEY on line 981. The buildClaudeEnv function applies customEnv after stripping, so this works correctly even in dev mode. An optional secondary cleanup is updating the UI label in the settings tab to match.

The comment on the issue includes the full analysis with file references, a detailed fix plan, dev-mode interaction analysis, impact assessment, and testing steps.

---

View full conversation

Powered by 1Code

[1code-async]

Task completed.

I've posted a detailed analysis comment on issue #165. Here's a summary of what I found:

The bug is confirmed. The environment variable name mismatch at src/main/lib/trpc/routers/claude.ts:981 (ANTHROPIC_AUTH_TOKEN) vs the check at line 1171 (ANTHROPIC_API_KEY) causes the API key to be ignored, falling through to OAuth.

I also analyzed a potential complication in dev mode where ANTHROPIC_API_KEY is stripped from the environment (src/main/lib/claude/env.ts:32-33), but confirmed the proposed fix still works because customEnv overrides are applied after the stripping step in buildClaudeEnv().

The single-line fix proposed in the issue is correct and sufficient.

---

View full conversation

Powered by 1Code

[1code-async]

Issue Analysis

Confirmed: The root cause identified in this issue is accurate. There is an environment variable name mismatch that causes the API key to be ignored.

The Bug

In src/main/lib/trpc/routers/claude.ts:

• Line 981: The API key is set as ANTHROPIC_AUTH_TOKEN in the customEnv passed to buildClaudeEnv()
• Line 1171: The guard check looks for ANTHROPIC_API_KEY to decide whether to skip OAuth

Since the key is stored under ANTHROPIC_AUTH_TOKEN but the check reads ANTHROPIC_API_KEY, hasExistingApiConfig evaluates to false (unless ANTHROPIC_BASE_URL is set), and the code falls through to inject CLAUDE_CODE_OAUTH_TOKEN at line 1184-1187, triggering the OAuth login flow.

Additional Complication in Dev Mode

There is a second layer to this bug in dev mode. In src/main/lib/claude/env.ts:29-34, ANTHROPIC_API_KEY is explicitly stripped from the environment when app.isPackaged is false:

const STRIPPED_ENV_KEYS = !app.isPackaged
  ? [...STRIPPED_ENV_KEYS_BASE, "ANTHROPIC_API_KEY"]
  : STRIPPED_ENV_KEYS_BASE

This means that even if the proposed fix (changing ANTHROPIC_AUTH_TOKEN → ANTHROPIC_API_KEY on line 981) is applied, the key would be stripped again by buildClaudeEnv() during step 2b (line 243-248) in dev mode, because customEnv is applied at step 4 (line 266-273) — after the stripping. So in the current code flow, customEnv overrides survive the stripping and the fix should work correctly for both dev and production.

To confirm: buildClaudeEnv() in src/main/lib/claude/env.ts:213-282 applies customEnv at step 4 (line 266-273), which is after the strip at step 2b (line 243-248). So the proposed fix of using ANTHROPIC_API_KEY in the customEnv will correctly survive the stripping, and the guard check at line 1171 will find the key as expected.

Proposed Fix Validation

The proposed fix is correct:

  const claudeEnv = buildClaudeEnv({
    ...(finalCustomConfig && {
      customEnv: {
-       ANTHROPIC_AUTH_TOKEN: finalCustomConfig.token,
+       ANTHROPIC_API_KEY: finalCustomConfig.token,
        ANTHROPIC_BASE_URL: finalCustomConfig.baseUrl,
      },
    }),
    enableTasks: input.enableTasks ?? true,
  })

Additional Changes to Consider

After renaming the env var, there are a few other references to ANTHROPIC_AUTH_TOKEN that should be updated for consistency, though they are cosmetic/logging only:

1. src/main/lib/trpc/routers/claude.ts:1215-1216 — debug log checking ANTHROPIC_AUTH_TOKEN
2. src/main/lib/trpc/routers/claude.ts:1351-1353 — Ollama debug logging ANTHROPIC_AUTH_TOKEN
3. src/main/lib/claude/env.ts:307 — logClaudeEnv() logs ANTHROPIC_AUTH_TOKEN
4. src/renderer/components/dialogs/settings-tabs/agents-models-tab.tsx:435 — UI label says "ANTHROPIC_AUTH_TOKEN env"

Items 1-3 are debug logs that won't affect functionality but should be updated to avoid confusion. Item 4 is a user-facing label in the settings UI that should reflect the correct env var name.

Related Context

• The hasExistingApiConfig guard was introduced via PR feat: support existing Claude CLI configuration #29 to allow users with existing Claude CLI API proxy configurations to bypass OAuth. The API key billing method was added later but used a different env var name, creating this mismatch.
• No duplicate issues found.

[1code-async]

Issue Analysis

Good catch — the root cause analysis is correct. Here's a detailed breakdown of the code path and why this happens:

Confirmed: Environment variable name mismatch

The mismatch:

• src/main/lib/trpc/routers/claude.ts:981 — the API key is set as ANTHROPIC_AUTH_TOKEN
• src/main/lib/trpc/routers/claude.ts:1171 — the gate check looks for ANTHROPIC_API_KEY

What happens at runtime:

1. User enters an API key → stored in finalCustomConfig.token
2. buildClaudeEnv() is called with customEnv: { ANTHROPIC_AUTH_TOKEN: token } (line 978-986)
3. buildClaudeEnv() in src/main/lib/claude/env.ts:266-273 correctly applies custom overrides — so claudeEnv.ANTHROPIC_AUTH_TOKEN is set
4. Back in claude.ts:1170-1172, the code checks claudeEnv.ANTHROPIC_API_KEY — which was never set → hasExistingApiConfig is false
5. Since hasExistingApiConfig is false, the code falls through to inject CLAUDE_CODE_OAUTH_TOKEN instead (line 1184-1187), triggering the OAuth prompt

Dev mode complication

There's an additional wrinkle for dev mode specifically. In src/main/lib/claude/env.ts:32-33:

const STRIPPED_ENV_KEYS = !app.isPackaged
  ? [...STRIPPED_ENV_KEYS_BASE, "ANTHROPIC_API_KEY"]
  : STRIPPED_ENV_KEYS_BASE

In dev mode, ANTHROPIC_API_KEY is actively stripped from the environment (lines 243-248 in env.ts). This means even if the fix changes ANTHROPIC_AUTH_TOKEN → ANTHROPIC_API_KEY on line 981, the key would be stripped by buildClaudeEnv() before it's returned.

However, looking more carefully at the order of operations in buildClaudeEnv():

1. Line 243-248: Strip sensitive keys (including ANTHROPIC_API_KEY in dev)
2. Line 266-273: Apply customEnv overrides after stripping

So the custom env override happens after stripping, meaning the proposed fix would work in both dev and production. The strip only removes keys inherited from the shell environment, not explicitly passed custom overrides.

Proposed fix is correct

The fix from the issue description is the right approach:

  customEnv: {
-   ANTHROPIC_AUTH_TOKEN: finalCustomConfig.token,
+   ANTHROPIC_API_KEY: finalCustomConfig.token,
    ANTHROPIC_BASE_URL: finalCustomConfig.baseUrl,
  },

File: src/main/lib/trpc/routers/claude.ts:981

This single-line change aligns the variable name so hasExistingApiConfig (line 1170-1172) correctly detects the API key and skips the OAuth flow.

Optional cleanup

The debug log at src/main/lib/claude/env.ts:307 still references ANTHROPIC_AUTH_TOKEN — it may be worth updating that to log ANTHROPIC_API_KEY instead (or both) after this fix, to avoid confusion during future debugging.

No duplicate issues found

No prior issues cover this specific bug.

[1code-async]

Issue Analysis

I've verified this bug by examining the codebase. The issue author's diagnosis is correct — there is an environment variable name mismatch that causes API key mode to fall through to OAuth.

Root Cause Confirmed

The mismatch:

• src/main/lib/trpc/routers/claude.ts:981 — the user's API key is set as ANTHROPIC_AUTH_TOKEN via customEnv
• src/main/lib/trpc/routers/claude.ts:1170-1172 — the guard checks for ANTHROPIC_API_KEY

Since the key is stored under the wrong name, hasExistingApiConfig evaluates to false, and the code falls through to the OAuth path at line 1184-1187, which sets CLAUDE_CODE_OAUTH_TOKEN. When no OAuth token is available (API key users haven't authenticated via OAuth), this triggers the OAuth login prompt.

Dev Mode Compounds the Problem

In dev mode (!app.isPackaged), ANTHROPIC_API_KEY is explicitly stripped from the environment in src/main/lib/claude/env.ts:32-34:

const STRIPPED_ENV_KEYS = !app.isPackaged
  ? [...STRIPPED_ENV_KEYS_BASE, "ANTHROPIC_API_KEY"]
  : STRIPPED_ENV_KEYS_BASE

This means even if the fix changes ANTHROPIC_AUTH_TOKEN → ANTHROPIC_API_KEY, there's a second issue: in dev mode, buildClaudeEnv strips ANTHROPIC_API_KEY before custom overrides are applied... but actually, looking at the code flow more carefully:

1. buildClaudeEnv strips ANTHROPIC_API_KEY from shell env (line 243-248)
2. Then applies customEnv overrides (lines 266-274)

So the custom override would re-add ANTHROPIC_API_KEY after stripping, which is the correct behavior — the stripping only targets keys inherited from the developer's shell, not explicit user input.

Detailed Fix Plan

Single change required in src/main/lib/trpc/routers/claude.ts:981:

  const claudeEnv = buildClaudeEnv({
    ...(finalCustomConfig && {
      customEnv: {
-       ANTHROPIC_AUTH_TOKEN: finalCustomConfig.token,
+       ANTHROPIC_API_KEY: finalCustomConfig.token,
        ANTHROPIC_BASE_URL: finalCustomConfig.baseUrl,
      },
    }),
    enableTasks: input.enableTasks ?? true,
  })

Why this is sufficient:

• buildClaudeEnv applies customEnv last (line 266-274 of env.ts), so the key won't be stripped
• The hasExistingApiConfig check at line 1170 will then correctly detect the API key
• The OAuth token will be skipped (line 1184-1185: !hasExistingApiConfig will be false)
• The Claude SDK/CLI expects ANTHROPIC_API_KEY, not ANTHROPIC_AUTH_TOKEN

Optional secondary cleanup — update the UI label in src/renderer/components/dialogs/settings-tabs/agents-models-tab.tsx:

The settings tab currently labels the token field as "ANTHROPIC_AUTH_TOKEN env" (around line 444). This should be updated to ANTHROPIC_API_KEY to match the actual variable name after the fix.

Impact Assessment

• Scope: One-line fix (+ optional UI label update)
• Risk: Low — this only changes the environment variable name for user-provided API keys
• Testing:
  1. Set billing method to "Anthropic API Key", enter a valid key, verify chat works without OAuth prompt
  2. Verify OAuth flow still works when no API key is configured
  3. Verify existing shell ANTHROPIC_API_KEY detection still works in production builds
  4. Verify Ollama/custom model flows are unaffected (they use different config paths)

Relevant Files

File	Lines	Role
src/main/lib/trpc/routers/claude.ts	978-986, 1167-1190	Bug location: env var mismatch
src/main/lib/claude/env.ts	213-282	buildClaudeEnv — applies customEnv overrides
src/main/lib/claude/env.ts	29-34	Dev mode ANTHROPIC_API_KEY stripping
src/renderer/components/dialogs/settings-tabs/agents-models-tab.tsx	~444	UI label referencing the env var name