When several credentials exist, Claude Code picks one in a fixed order. Cloud provider variables come first, then bearer token, then ANTHROPIC_API_KEY, then a key helper, then the CI token, and subscription login last. A stray API key in your shell can silently override your Pro or Team login.
The order
Per Anthropic's authentication documentation:
- Cloud provider credentials, when the Bedrock, Vertex or Foundry switch variables are set.
ANTHROPIC_AUTH_TOKEN, sent as a bearer header, for gateways.ANTHROPIC_API_KEY, sent as an API key header. In interactive mode you are asked once to approve it, and the choice is remembered.- Output of an
apiKeyHelperscript, for rotating credentials. CLAUDE_CODE_OAUTH_TOKEN, a long-lived token for CI.- Anthropic profile and federation credentials.
- Subscription OAuth credentials from
/login, the default for Pro, Max, Team and Enterprise.
A signed-in self-hosted gateway session sits outside the list and outranks the cloud providers.
The common surprise
The docs describe it directly: if you have an active subscription but also have an API key in your environment, Claude Code uses the key once you approve it. That can fail if the key belongs to a disabled or expired organization, or it can bill the API instead of using plan allowance. The fix is to unset the variable and check /status, which shows which method is active and marks the credential not in use.
Credentials in CI
Run the setup token command to generate a one-year OAuth token for pipelines. It prints the token and does not save it, so you copy it into the environment variable or a secret store. It requires a Pro, Max, Team or Enterprise plan, can only make model requests, and cannot establish remote control sessions or fetch claude.ai connectors. Bare mode does not read it, so scripts using bare mode need an API key or key helper.
Where credentials are stored
On macOS they go in the Keychain, with a fallback file of mode 0600 when the Keychain write fails. On Linux they are a file with mode 0600 under ~/.claude/, and on Windows a file in the user profile directory. Setting CLAUDE_CONFIG_DIR moves that location, which also gives you a clean way to keep work and personal logins apart, with a separate directory for each.
For admins
Managed settings can force a login method and organization with forceLoginMethod and forceLoginOrgUUID. The docs note that when those are set, environment credentials such as an API key are blocked at startup, because membership cannot be verified. Deploy those keys through device management, since server-managed settings only reach accounts that are already signed in.
Quick check
I pay for a subscription but get API billing. Why?
An API key variable is probably set and was approved. Unset it and run /status.
Does the CI token work for scheduled routines or connectors?
No. The documentation says it can only make model requests.
Sources
Last reviewed: 19 October 2026.
