[FEATURE] Make OAuth/admin base URL configurable like ANTHROPIC_BASE_URL
Preflight Checklist
- [x] I have searched existing requests and this feature hasn't been requested yet
- [x] This is a single feature request (not multiple features)
Problem Statement
ANTHROPIC_BASE_URL correctly routes inference calls through custom endpoints, but ~30 OAuth and admin endpoints (/api/oauth/*, /api/claude_code/*, /v1/sessions/*, /v1/mcp_servers, event logging, etc.) use a hardcoded BASE_API_URL (https://api.anthropic.com) that ignores any configured base URL. API key authentication already works cleanly, ANTHROPIC_BASE_URL is respected across the board, but the OAuth path lacks the same configurability.
Proposed Solution
Remove the allowlist restriction on CLAUDE_CODE_CUSTOM_OAUTH_URL so it accepts arbitrary URLs, bringing OAuth endpoint routing to parity with how ANTHROPIC_BASE_URL already works for inference.
Alternative Solutions
- Add a new env var (e.g.
ANTHROPIC_OAUTH_BASE_URL) specifically for non-inference endpoints. - The recent addition of custom TLS certificate support makes MITM approaches easier, but delegating authentication to a gateway that injects credentials without breaking the in-container chain of trust is a cleaner solution than TLS interception.
Priority
Medium - Would be very helpful
Feature Category
Configuration and settings
Use Case Example
We run interactive containerized Claude Code agents (like a secure sandbox for your personal AI coding agent on your own dev machine - similar to Docker Sandboxes, but based on podman) with a host-side credential gateway that swaps phantom tokens for real credentials (terok-sandbox). This works perfectly for API key auth via ANTHROPIC_BASE_URL, for OAuth, the credential gateway can even correctly request and obtain OAuth key refreshes adn route the inference path from the container to the Anthropic servers without revealing the real credentials inside the container, but the hardcoded OAuth endpoints bypass it, breaking subscription features (usage, profile, settings, connectors).
Additional Context
CLAUDE_CODE_CUSTOM_OAUTH_URLexists but is restricted to an internal allowlist of Anthropic-owned URLs.- #22992 — device-code auth for headless environments (different approach, same audience — multiple commenters noted that
CLAUDE_CODE_OAUTH_TOKENworkaround loses subscription features like usage display and connectors) - PR #5490 — containerized Claude Code with host credential delegation (discussion touched on dynamic credential replacement in the forwarding layer)
6 Comments
Found 3 possible duplicate issues:
This issue will be automatically closed as a duplicate in 3 days.
🤖 Generated with Claude Code
IMHO these are related but not duplicates - partially they're different symptoms of the same root cause, but each existing issue has a different scope than this one:
| Issue | Type | Symptom |
|-------|------|---------|
| #36998 | Bug | Interactive mode startup fails behind proxy (startup auth calls bypass
ANTHROPIC_BASE_URL) || #29015 | Bug | Fast mode force-disabled behind proxy (penguin-mode check hardcodes
api.anthropic.com) || #5082 | Question | "How do I do credential proxying in containers?" (stale/autoclosed, links to #5490 which seems abandoned) |
| This issue | Feature | Make the OAuth/admin base URL configurable — the fix for the underlying design gap |
All four touch the same hardcoded
BASE_API_URL, but #36998 and #29015 report specific breakages (startup failure, fast-mode loss). #5082 was the closest match, but it basically asks about a full credential gate implementation. We have a working credential gate which only lacks certain features when operated in OAuth mode. This issue proposes a concrete solution: unlockingCLAUDE_CODE_CUSTOM_OAUTH_URL(or equivalent) so that all ~30 OAuth/admin endpoints respect a configurable base URL, just asANTHROPIC_BASE_URLalready works for inference.This would be incredibly useful for enterprise/proxy setups
Strong +1 on this. The current design has a fundamental gap:
ANTHROPIC_BASE_URLonly covers the inference path, while OAuth/admin calls are hardcoded toapi.anthropic.com.For anyone running Claude Code behind a corporate proxy, a multi-model gateway (e.g. LiteLLM), or a managed API relay, this means:
ANTHROPIC_BASE_URLroutes chat/completions correctlyapi.anthropic.comdirectly, which may be blocked or return unexpected errors behind a proxyThe table in the issue description nails it — #36998 (startup failure) and #29015 (fast-mode force-disabled) are both downstream symptoms of this same hardcoded URL.
A
CLAUDE_CODE_ADMIN_BASE_URLor similar env var would solve all three at once. For proxy/gateway operators who implement the admin endpoints, this would make Claude Code fully self-hostable behind corporate firewalls.In the meantime, the
ANTHROPIC_CUSTOM_HEADERSworkaround mentioned in #44752 can help with some auth issues, but it does not fix the hardcoded OAuth endpoint problem.Closing for now — inactive for too long. Please open a new issue if this is still relevant.
This is not stale!
This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.