Skip to content

Don't ask an API-key Claude Code login to sign in - #16099

Open
osbase77 wants to merge 3 commits into
omacom:quattrofrom
osbase77:agents-api-key
Open

osbase77 wants to merge 3 commits into
omacom:quattrofrom
osbase77:agents-api-key

Conversation

@osbase77

@osbase77 osbase77 commented Oct 20, 2026 •

Copy link
Copy Markdown

Problem

Claude Code can be signed in with an API key instead of a Claude subscription: a primaryApiKey in ~/.claude.json, an apiKeyHelper or a key in the env block of ~/.claude/settings.json, or ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN in its environment. That login needs no OAuth credentials, and with none saved, omarchy-agent-usage-claude reports Waiting for auth, so the agents panel shows Sign-in required under Claude Code even though it works.

Fix

Where the subscription would ask for a sign-in (there is none, or it expired), a configured key stands in, the way #14040 handles a Codex API-key login: no plan, no limits and no status. A subscription that isn't asking for a sign-in keeps its plan. The environment checked is the desktop session's, which the panel runs in, and as in Claude Code, the settings' env block is applied over it, and an ANTHROPIC_API_KEY Claude Code was told not to use doesn't count. Registered accounts read the same way. Only whether a key is configured is checked; the key itself is never recorded.

Testing

  • agent-usage-claude-limits: a key stands in for a missing or expired sign-in and never reaches the record; a refreshable subscription keeps its plan; an exported key counts unless the settings' env block empties it or Claude Code was told not to use it.
  • agent-usage-accounts: an account on its key has no plan, not even the one its registry entry kept.
  • The other Claude collector tests pass (agent-usage-claude-plan, agent-usage-claude-scanner, agent-usage-partition).
  • On a real machine signed in to Claude Code with an API key, quattro's collector reports Waiting for auth, and this branch's no status.

🤖 Generated with Claude Code

@greptile-apps

greptile-apps Bot commented Oct 20, 2026 •

Copy link
Copy Markdown
Contributor

RetriggerView in GreptileConfidence Score: 4/5

[Medium impact] The change affects Claude Code usage and account status in the agents panel.

The previous visibility issue remains partly unfixed, so this PR still needs a change before merging.

Findings

  1. P1 API-key login stays hidden ▶

Summary

Removes unnecessary sign-in prompts when Claude Code has a configured API key.

  • Claude Code API-key logins no longer ask users to sign in.

Reviews (8) · Last reviewed commit: "Count registered Claude accounts as Clau..." · Reviewed by Greptile

Comment thread shell/plugins/agents/Panel.qml Outdated
Comment thread bin/omarchy-agent-usage-claude Outdated
@osbase77 osbase77 changed the title Show API-key Claude logins as "API key", not "Sign-in required" Show API-key Claude and Codex logins as "API key", not "Sign-in required" Oct 21, 2026
@omarchybot omarchybot added bug Something isn't working verified Omarchy Triage has verified that this issue is ready for final review ready Good to merge labels Oct 22, 2026
@omarchybot

Copy link
Copy Markdown
Collaborator

Reviewed at fac7cc7 and found nothing to change.

The bug is real. On a disposable Omarchy VM running current quattro, the Claude collector reads Waiting for auth with an API key configured as primaryApiKey, in the settings' env block, or exported. On this branch it reads API key, with no status and no sign-in prompt. The result is the same with the branch merged into current quattro. With no key, or with an exported key that the settings' env block empties, it still asks for a sign-in. The new Codex test fails on quattro and passes here.

./test/cli passes on the branch and on the merge, and so does every agent-usage-*, agent-account-* and agents-panel test. i18n-test.sh fails on da/menu.json mirrors the English catalog, but it fails identically on quattro, so it has nothing to do with this change. The panel's rendering was checked through agents-panel-test.sh rather than by eye.

Codex Medium gave a second opinion and found no defects: the Claude fallback only replaces the two sign-in statuses, both of which return before any network call or cache write, and the Codex account/read request only turns an auth refusal into API key when Codex itself names an apiKey login. It also noted that account rows now capitalise their plan the way the provider heading already did (plus reads Plus), which is consistent. It had my own conclusions to read, so its agreement is not guaranteed to be independent.

Nothing is waiting on you. It is with the maintainer now.

Claude Code signed in with an API key (pay as you go through the Anthropic
Console) has no OAuth credentials, so the collector reported Waiting for
auth and the panel asked for a sign-in the key makes unnecessary. Where
the subscription would ask for one (there is none, or it expired), a key
configured for the CLI now stands in, as omacom#14040 has Codex do: no plan, not
even the one a registered account was saved with, no limits, nothing to
sign in to, and the same note. The key is the CLI's own, an apiKeyHelper
or env block in its user settings, or its exported variables, with the
settings' env block applied over them and an ANTHROPIC_API_KEY the CLI was
told not to use left out, as Claude Code does. Only whether a key is
configured is checked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
# network.
def with_api_key(claude_dir: Path, plan: str, limits: dict[str, Any]) -> tuple[str, dict[str, Any]]:
if limits["usageStatusText"] in SIGN_IN_STATUSES and api_key_login(claude_dir):
return "", {"limits": [], "usageStatusText": "", "authHelpText": API_KEY_HELP, "live": True, "fetchedAtMs": 0, "apiKey": True}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 API-key login stays hidden

Before the first session, with_api_key returns an empty plan and no limits, while main leaves ready false without local usage. providerHasData then drops Claude Code from the panel. After a session, it appears but still has no “API key” label: planLabel receives the empty plan, and the empty status hides the help text.

Return a visible API-key tier and mark this login ready, including for registered accounts.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The label stays empty, as the collector contract #14040 added (docs/agent-usage-collectors.md) has it: tierLabel is the plan as the service names it, never a placeholder, and a login without plan limits shows no status. That leaves a single key-only login with no local usage unlisted, the same as a Codex API-key login on quattro. Readiness now counts credentials as the contract does: where Claude Code is set up, a configured key or two or more registered accounts make the record ready (35b6504, 8a3de67).

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You're right. I conflated record readiness with panel visibility, and recommending an “API key” tier would violate the collector contract. The updated readiness handles configured keys and registered accounts; a key-only login with no local usage and no plan is intentionally unlisted, matching Codex. I withdraw the finding.

@osbase77 osbase77 changed the title Show API-key Claude and Codex logins as "API key", not "Sign-in required" Don't ask an API-key Claude Code login to sign in Oct 24, 2026
osbase77 and others added 2 commits October 24, 2026 17:43
The collector contract makes a record ready once the agent is in use on
the machine, by a credential or by local usage, and a key standing in for
the sign-in is a credential.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Each registered account is a credential, which makes the record ready
under the collector contract, as Codex's already is.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@omarchybot omarchybot removed verified Omarchy Triage has verified that this issue is ready for final review ready Good to merge labels Oct 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants