Claude Code Desktop silently uses project API keys for billing instead of subscription

Summary

When using Claude Code on Desktop (not terminal), it appears to select API keys found in project environment variables and bills usage against them, rather than using the user's Claude subscription.

What happened

1. Started using Claude Code on Desktop to try Opus 4.7
2. Claude silently picked up an Anthropic API key stored in a project's environment/secrets (used by Supabase edge functions, not intended for Claude Code)
3. With auto-billing enabled on the API account, multiple $200 charges started hitting
4. Took hours to trace the unexpected billing back to Claude Code Desktop using the project API key

Expected behavior

Claude Code Desktop should use the user's Claude subscription for usage, not discover and use API keys from project environment variables, Vercel env, or Supabase secrets.

Impact

• Unexpected charges on API billing (multiple $200 auto-billing events)
• Had to rotate all API keys
• Had to disable all APIs and stop using Claude Desktop as a precaution
• Hours of debugging to identify the root cause

Environment

• Claude Code on Desktop (macOS)
• Project has ANTHROPIC_API_KEY set in Vercel environment variables and Supabase secrets (for edge functions, not for Claude Code)

Suggestion

• Claude Code should never silently use API keys found in project configs for its own billing
• If it detects an API key, it should explicitly ask the user which billing method to use
• Clear indication in the UI of which billing method is active