Persistent Warning When Using API Key Directly

Related Discovery: API Key from Disabled Org Causes Confusing Error

This persistent warning about API keys becomes even more problematic when the API key is from a disabled organization.

I discovered that having ANTHROPIC_API_KEY set to a key from a disabled org causes:

1. Override of valid Max/Pro subscription (as you noted)
2. Misleading error: "This organization has been disabled"
3. No indication that removing the API key would fix it

The error message makes users think their account is disabled, when actually it's just the old API key causing issues.

Full investigation and solution: #8327

Suggestion: When Claude Code detects an API key from a disabled org, the error should explicitly say:

"API key from disabled organization detected.
You have a valid Max subscription.
Remove ANTHROPIC_API_KEY to use your subscription."

This would save hours of debugging for users who don't realize an old work/school API key is overriding their personal subscription.

bump!

Why is there no progress here? This so not 12-factor. Idempotency please! We should be able to circumvent interaction for these things....pffff

Ok, I found out how to do it, by piecing things together:

claude --settings '{"forceLoginMethod": "claudeai"}'

Hope this helps y'all, but I suggest anthropic bots or peeps add it to the troubleshooting/faq...

Do you know the possible values for forceLoginMethod? How did you piece that setting together?

I am trying start claude code with with ANTHROPIC_API_KEY, not with claudeai

guys. this is INSANE. vibe it already?

When launching the Claude CLI with an explicitly specified settings file, an authentication conflict warning appears, even though the system correctly uses the provided token.

Have a settings file ~/.claude/settings.json with the following content:

{
  "env": {
    "ANTHROPIC_AUTH_TOKEN": "<TOKEN>",
    "ANTHROPIC_BASE_URL": "https://api.anthropic.com"
  },
  "alwaysThinkingEnabled": true
}

Launch Claude CLI with the specified settings file:

claude --settings ~/.claude/settings.json

A warning message appears:

⚠Auth conflict: Both a token (ANTHROPIC_AUTH_TOKEN) and an API key (/login managed key) are set. This may lead to unexpected behavior.
    • Trying to use ANTHROPIC_AUTH_TOKEN? claude /logout
    • Trying to use /login managed key? Unset the ANTHROPIC_AUTH_TOKEN environment variable.
Welcome to Opus 4.5

However, authentication via the provided token works correctly — API requests use the specified ANTHROPIC_AUTH_TOKEN.

Expected Result:

1. The CLI should prioritize the explicitly provided configuration via --settings
2. If ANTHROPIC_AUTH_TOKEN is specified in the explicitly passed configuration file, the system should use it without conflict warnings
3. Ability to forcibly suppress this warning (e.g., via a --quiet flag or additional setting)

Anything new about this ?
We are having the same problem, trying to logout to use ANTHROPIC_API_KEY but it does not let us use it without login in

Proposed Fix for #4733: Auth Conflict Warning with ANTHROPIC_API_KEY

Problem

Setting ANTHROPIC_API_KEY while an OAuth credential exists produces a persistent, unresolvable warning on every startup:

⚠ Auth conflict: Using ANTHROPIC_API_KEY instead of Anthropic Console key.
Either unset ANTHROPIC_API_KEY, or run `claude /logout`.

Neither action fixes it — /logout forces re-auth and the warning returns; unsetting the key defeats the user's intent.

Root Cause

The auth system treats ANTHROPIC_API_KEY + OAuth credential as a conflict, rather than recognizing the env var as an intentional override.

Proposed Fix

1. ANTHROPIC_API_KEY should win silently. When set, skip the OAuth credential check — no warning needed. The user made their choice.

ANTHROPIC_API_KEY (env var) > OAuth credential > interactive login prompt

2. Add "Use API key" as a login method. Let users explicitly select API key auth during onboarding instead of forcing OAuth first:

How would you like to authenticate?
  ❯ Anthropic Console account (OAuth)
    Use API key (from ANTHROPIC_API_KEY environment variable)
    AWS Bedrock
    Google Vertex

3. Add a suppressAuthConflictWarning setting for users who need both credentials present. The existing forceLoginMethod workaround proves users need this control, but it shouldn't require a CLI flag every invocation.

Enterprise Impact — Cost Governance Blocker

This isn't just a UX annoyance — it breaks enterprise spend management.

Enterprise workspaces use API keys with spend limits to cap per-team budgets:

Organization budget: $15,000/mo
  ├── Engineering workspace key:  $6,000 cap
  ├── Data Science workspace key: $4,500 cap
  ├── QA workspace key:           $2,500 cap
  └── Unallocated buffer:         $2,000

The intended flow: admin creates a spend-capped workspace key → distributes to team → team sets ANTHROPIC_API_KEY → usage tracks against that workspace's limit.

What actually happens: Users set the workspace key, hit the auth conflict warning, can't resolve it, and either give up (reverting to OAuth which draws from the entire org pool with no cap) or deal with the warning on every startup.

The result is a budget leak — enterprise admins cannot enforce workspace spend boundaries because Claude Code actively discourages the configuration that makes them work.

| What admins need | What happens today |
|---|---|
| User uses workspace-scoped API key | Auth conflict warning every startup |
| Usage counts against workspace cap | Users revert to OAuth → org-wide pool, no limits |
| Clean onboarding: "set this env var" | Confusing warning with no working fix |

Why This Matters

• Enterprise cost governance: Workspace spend limits are unenforceable when the tool warns users away from the keys that enable them
• CI/CD & automation: Non-interactive startup shouldn't warn on intentional config
• 12-factor compliance: Env-var-based configuration is standard practice
• Developer trust: An unresolvable warning erodes confidence in the tool

I had this issue and it was the result of Claude Code credentials stored in MacOS Keychain. I don't recall ever intentionally storing Claude Code credentials in Keychain so I was surprised when I opened up Keychain Access and saw the entry. I deleted it and now when I log in I'm asked if I want to use the API Key, I select it and I am now logged in without getting routed to the console and the warning is gone.