Skip to content

fix(auth): stop treating CLAUDE_CODE_OAUTH_TOKEN as Anthropic API key#19260

Closed
alanxchen85 wants to merge 1 commit into
NousResearch:mainfrom
alanxchen85:fix/windows-oauth-token-interference
Closed

fix(auth): stop treating CLAUDE_CODE_OAUTH_TOKEN as Anthropic API key#19260
alanxchen85 wants to merge 1 commit into
NousResearch:mainfrom
alanxchen85:fix/windows-oauth-token-interference

Conversation

@alanxchen85

@alanxchen85 alanxchen85 commented May 3, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Remove CLAUDE_CODE_OAUTH_TOKEN from Anthropic provider's api_key_env_vars in auth.py
  • Remove from extra_env_vars in providers.py
  • Remove from auth status fallback in web_server.py

Problem

When Hermes runs alongside Claude Code (common on dev machines), it picks up CLAUDE_CODE_OAUTH_TOKEN and tries to use it for Anthropic API requests. The token is an OAuth token scoped to Claude Code's client ID — the Anthropic API rejects it with HTTP 400. This causes silent auth failures or crash loops.

The token is already blocked from terminal subprocesses (local.py line 53) and marked as implicit in setup.py, but the auth resolver still treats it as a valid API key.

Fix

Remove CLAUDE_CODE_OAUTH_TOKEN from the three places that use it as an Anthropic credential. Users who want Anthropic access in Hermes should set ANTHROPIC_API_KEY explicitly.

Test plan

  • Hermes no longer auto-detects Anthropic as configured when only CLAUDE_CODE_OAUTH_TOKEN is present
  • hermes setup still prompts for Anthropic API key correctly
  • Explicit ANTHROPIC_API_KEY still works as before
  • No regression on machines without Claude Code installed

Fixes #15080

🤖 Generated with Claude Code

@alanxchen85
fix(auth): stop treating CLAUDE_CODE_OAUTH_TOKEN as Anthropic API key
7b5f80a 
CLAUDE_CODE_OAUTH_TOKEN is an OAuth token scoped to Claude Code. When
Hermes runs in the same environment as Claude Code (common on dev
machines), it picks up this token and tries to use it for Anthropic
API requests. The Anthropic API rejects it with HTTP 400 because the
token is bound to Claude Code's OAuth client, not Hermes.

This causes silent auth failures or crash loops when the user has
Claude Code installed but hasn't explicitly configured Anthropic
credentials for Hermes.

Remove CLAUDE_CODE_OAUTH_TOKEN from:
- auth.py: Anthropic provider api_key_env_vars
- providers.py: Anthropic HermesOverlay extra_env_vars
- web_server.py: auth status endpoint fallback

The token is already in the terminal subprocess blocklist (local.py)
and marked as implicit in setup.py, so this completes the separation.
Users who want Anthropic access in Hermes should set ANTHROPIC_API_KEY
explicitly.

Fixes #15080
@alt-glitch alt-glitch added type/bug Something isn't working P2 Medium — degraded but workaround exists comp/cli CLI entry point, hermes_cli/, setup wizard area/auth Authentication, OAuth, credential pools provider/anthropic Anthropic native Messages API labels May 3, 2026
@ShinonKagura ShinonKagura mentioned this pull request May 3, 2026
Closed
1 task
@LeonSGP43 LeonSGP43 mentioned this pull request May 7, 2026
Open
@teknium1

teknium1 commented May 7, 2026

Copy link
Copy Markdown
Contributor

Thanks for the PR. Closing — picking up CLAUDE_CODE_OAUTH_TOKEN for Anthropic auth is intentional in Hermes. The adapter recognizes cc--prefixed tokens as valid Anthropic OAuth (see _looks_like_anthropic_oauth_token in agent/anthropic_adapter.py:320) and uses the Bearer auth path for them. That's a feature — it lets users who have Claude Code installed use Anthropic through Hermes without re-authenticating.

Your bug report (HTTP 400) suggests the OAuth handling didn't work for your specific scenario — that's worth investigating, but the fix isn't to drop the pickup entirely. Could you file an issue with the exact error body and the token prefix (cc- / eyJ / sk-ant-oat- etc. — don't paste the token itself) so we can see which code path rejected it?

@teknium1 teknium1 closed this May 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/auth Authentication, OAuth, credential pools comp/cli CLI entry point, hermes_cli/, setup wizard P2 Medium — degraded but workaround exists provider/anthropic Anthropic native Messages API type/bug Something isn't working

Projects

None yet

Milestone

No milestone

3 participants

@alanxchen85 @teknium1 @alt-glitch