Anthropic OAuth Explained: Subscription Login, API Keys, and Third-Party Tools

In Anthropic's ecosystem, OAuth is the browser sign-in that connects a Claude account (Free, Pro, Max, Team or Enterprise) to Anthropic's own apps, such as Claude Code. It is a different credential from a Claude Console API key. Anthropic's legal documentation reserves subscription OAuth for native Anthropic applications; programmatic and third-party use is meant to run on API keys.

That distinction explains what an "Anthropic OAuth token" is, why a login that works in Claude Code may fail in another tool, and which credential to use instead. Each point below is sourced from Anthropic's own documentation.

What "OAuth" Means in the Anthropic Context

Anthropic gives developers two broad kinds of credentials, and they are governed and billed differently.

Subscription login (OAuth). You sign in through a browser with your Claude account. The app you signed in to, for example Claude Code, stores the resulting token and refreshes it for you. Usage counts against your subscription plan.

Console API key. You create a static secret in the Claude Console and send it with each request. Usage is billed to the Console organization that owns the key.

According to the Claude Code legal and compliance page, the Consumer Terms of Service apply to Free, Pro and Max users, while the Commercial Terms of Service apply to Team, Enterprise and Claude API users. The Consumer Terms themselves state that the Commercial Terms govern the use of any Anthropic API key and the Console.

The third row shows that "OAuth" and "subscription" are not strictly identical: the Claude Code authentication docs describe a Console sign-in that keeps an OAuth token as an Anthropic profile instead of creating an API key, and that token belongs to a Console organization.

How Claude Code Handles Each Login Path

The Claude Code authentication page describes the flow like this: on first launch, claude opens a browser window for you to log in. If the ANTHROPIC_API_KEY environment variable is already set, Claude Code skips the browser and asks you to approve that key instead.

You can authenticate with any of these account types:

• Claude Pro or Max: log in with your Claude.ai account.
• Claude for Teams or Enterprise: log in with the Claude.ai account your admin invited.
• Claude Console: log in with Console credentials, with or without creating an API key.
• Cloud providers: set the provider's environment variables; no browser login is needed.

Where the credential lives. Per the same docs, macOS stores credentials in the encrypted Keychain, Linux uses ~/.claude/.credentials.json with file mode 0600, and Windows uses %USERPROFILE%\.claude\.credentials.json. For how these credentials fit alongside settings files and project-level configuration, see our guide to Claude Code configuration layers and credential placement.

Which credential wins. When several credentials exist, the docs list a fixed order. Condensed:

1. Cloud provider credentials, when a provider flag such as CLAUDE_CODE_USE_BEDROCK is set
2. ANTHROPIC_AUTH_TOKEN, sent as an Authorization: Bearer header, intended for LLM gateways and proxies
3. ANTHROPIC_API_KEY, sent as the X-Api-Key header
4. Output of an apiKeyHelper script
5. CLAUDE_CODE_OAUTH_TOKEN, the long-lived token described below
6. Anthropic profile and federation credentials
7. Subscription OAuth credentials from /login

This ordering explains a common surprise. If you have an active subscription but ANTHROPIC_API_KEY is also exported in your shell, Claude Code uses the key once you approve it. The docs recommend running unset ANTHROPIC_API_KEY to fall back to the subscription and checking /status to confirm which method is active.

The Long-Lived Token: claude setup-token

Searches for "anthropic oauth token" often lead here. According to the Claude Code authentication docs, claude setup-token generates a one-year OAuth token for CI pipelines, scripts and other places where a browser login is not possible.

claude setup-token
# The token is printed once after you approve access in the browser.
# Store it in your CI secret manager as CLAUDE_CODE_OAUTH_TOKEN.

What the docs say about this token:

• It runs the same browser authorization flow as /login and does not save the token anywhere for you.
• It authenticates with your Claude subscription and requires a Pro, Max, Team or Enterprise plan.
• It can only make model requests, so features such as Remote Control and claude.ai connectors are unavailable with it.
• Bare mode (--bare) does not read CLAUDE_CODE_OAUTH_TOKEN; scripts using bare mode need ANTHROPIC_API_KEY or an apiKeyHelper instead.

The key point: this is still a subscription credential. It lets Claude Code itself run non-interactively. It is not a general-purpose API key, and the usage rules in the next section apply to it in the same way.

Anthropic OAuth in Third-Party Tools: What the Terms Say

Searches like "anthropic oauth ban" usually follow a subscription login failing in a non-Anthropic tool. Here is what the official documents state.

Claude Code legal and compliance page. Under "Authentication and credential use", Anthropic says OAuth authentication is intended exclusively for purchasers of Claude subscription plans and is designed to support ordinary use of Claude Code and other native Anthropic applications. The same section says:

• Developers building products or services that interact with Claude, including those using the Agent SDK, should use API key authentication through the Claude Console or a supported cloud provider.
• Anthropic does not permit third-party developers to offer Claude.ai login in their own applications, or to route requests through Free, Pro or Max plan credentials on behalf of their users.
• Developers may not collect, store or intermediate Claude.ai credentials or session tokens; sign-in must complete through Anthropic's own flow.
• Anthropic reserves the right to enforce these restrictions, and may do so without prior notice.

The page also notes that advertised usage limits for Pro and Max plans assume ordinary, individual usage of Claude Code and the Agent SDK.

Consumer Terms of Service. The Consumer Terms (the version shown on Anthropic's site is effective October 8, 2025) prohibit accessing the services through automated or non-human means, such as a bot or script, except via an Anthropic API key or where Anthropic explicitly permits it. They also prohibit sharing account login information or credentials with anyone else.

What the page does not restrict. Customers may provision their own API keys for their own authorized users, provided usage is billed to the key owner and not resold. End users may also sign in to the unmodified Claude Code binary with their own subscription.

Reported context. The Register reported on February 20, 2026 that Anthropic had updated its legal wording to state explicitly that subscription OAuth tokens may not be used in other products, tools or services, and that Anthropic described the change as a clarification of existing policy. The same report noted that some open-source coding tools, OpenCode among them, removed Claude subscription sign-in afterwards.

What this means in practice. If a third-party tool, whether OpenCode, OpenClaw, Hermes or another agent, offers to sign you in with a Claude Pro or Max account, that route falls outside what Anthropic's documentation permits for third-party products and may stop working at any time. Tool features change, so check the tool's current docs, and treat Anthropic's legal page as the authority on the rule. This guide does not cover ways around these restrictions.

The Supported Route for Programmatic and Third-Party Use

For your own code, agent frameworks, or non-Anthropic coding tools, the documented options are all API-key based.

1. A Claude Console API key. Create a key in the Console, keep it in a secret manager, and supply it through the tool's Anthropic provider setting or the ANTHROPIC_API_KEY environment variable. If you have not set up Console access and billing yet, our walkthrough of getting Anthropic Claude API access covers the path. If a new key returns errors, diagnosing an Anthropic API key that is not working maps each status code to its usual cause.

2. A cloud provider. Organizations already on Amazon Bedrock, Google Cloud's Agent Platform or Microsoft Foundry can use those credentials; Claude Code documents environment variables for each.

3. An LLM gateway that issues standard API keys. Claude Code's authentication docs describe ANTHROPIC_AUTH_TOKEN as the variable to use when routing through a gateway or proxy that authenticates with bearer tokens, combined with ANTHROPIC_BASE_URL for the endpoint. A legitimate gateway bills traffic to its own API keys. It should never ask for, store or relay your Claude.ai login, since the legal page rules that out.

A quick way to choose:

ROIBest AI is one such gateway: it issues standard API keys that work in OpenAI-compatible and Anthropic-compatible clients.

FAQ

Is Anthropic OAuth the same as an Anthropic API key?

No. OAuth is a browser sign-in whose token is stored and refreshed by an Anthropic app, while an API key is a static secret created in the Claude Console and billed under the Commercial Terms.

Can I use my Claude Pro or Max login in a third-party coding tool?

Anthropic's Claude Code legal page says it does not permit third-party developers to offer Claude.ai login or route requests through Free, Pro or Max credentials. For non-Anthropic tools, use a Console API key or a gateway-issued key.

What is CLAUDE_CODE_OAUTH_TOKEN?

It is the environment variable for the one-year token that claude setup-token generates, used to authenticate Claude Code in CI or scripts. It requires a Pro, Max, Team or Enterprise plan and only supports model requests.

Which credential does Claude Code use when several are set?

Cloud provider credentials come first, then ANTHROPIC_AUTH_TOKEN, ANTHROPIC_API_KEY, apiKeyHelper, CLAUDE_CODE_OAUTH_TOKEN, profiles, and finally the /login subscription credential. Run /status to see which one is active.