claude -p --bare ignores ANTHROPIC_API_KEY (and --settings.apiKey/apiKeyHelper) — auth always fails

Summary

claude -p --bare returns "Not logged in · Please run /login" for every invocation regardless of how the API key is supplied. The --help text explicitly promises:

Anthropic auth is strictly ANTHROPIC_API_KEY or apiKeyHelper via --settings (OAuth and keychain are never read).

In practice, none of three documented auth paths work.

Version

claude --version → 2.1.143 (Claude Code) · macOS 25.4.0 (Darwin)

Reproducer (all three paths fail)

# Path 1: ANTHROPIC_API_KEY env var (per --help)
ANTHROPIC_API_KEY=sk-ant-... claude -p --bare --max-turns 1 --output-format json "hi"
# → {"is_error":true, "result":"Not logged in · Please run /login"}

# Path 2: apiKey via --settings (per --help)
echo '{"apiKey":"sk-ant-..."}' > /tmp/s.json
claude -p --bare --settings /tmp/s.json --max-turns 1 --output-format json "hi"
# → same failure

# Path 3: apiKeyHelper via --settings (per --help)
echo '{"apiKeyHelper":"echo sk-ant-..."}' > /tmp/s.json
claude -p --bare --settings /tmp/s.json --max-turns 1 --output-format json "hi"
# → same failure

Tested with HOME=$(mktemp -d) (no prior CC state on disk) — same result.

Same ANTHROPIC_API_KEY env var works without --bare:

ANTHROPIC_API_KEY=sk-ant-... claude -p --max-turns 1 --output-format json "hi"
# → {"is_error":false, "result":"Hi there, friend."}

Impact

--bare is the recommended path for headless CI/CD invocations (skips plugin/hook/LSP load → predictable token cost). Without it, every CI workflow that uses Claude Code must use full plain claude -p, which roughly 2.5× the per-invocation token cost (and pulls in plugins+hooks that bare was meant to skip).

This is a recurring issue — my project has hit it across two separate workflows (yonatangross/orchestkit#1629 ~6 months ago, yonatangross/orchestkit#1857 today). Each time the workaround is the same: drop --bare. Filing here so it gets fixed upstream instead of being routed around for a third time.

Expected behavior

Either:

1. --bare honors ANTHROPIC_API_KEY env var per the help text — preferred, matches docs.
2. OR: --help text is corrected to document the actual auth path (3P providers only? specific env var name? specific settings shape?).

Suggested test addition

A non-interactive end-to-end test that exercises claude -p --bare --max-turns 1 --output-format json "..." with ANTHROPIC_API_KEY set and asserts is_error == false.

Workaround currently shipped downstream

fix(ci-sentinel): drop --bare (auth broken) — yonatangross/orchestkit#1857. Trade-off documented in the PR body.