API key scoping: differentiate application (API-only / Claude Code / Both)
Feature request
Anthropic API keys currently have no flag to scope which surface they apply
to. Once a key is enabled (including via auto-load), it is used for both
direct API calls and Claude Code session usage -- there is no way to issue
or mark a key as restricted to one or the other.
Requested behavior
Add a scope setting per API key with three states:
- ( ) API Only -- key usable for direct API calls, never picked up by a
Claude Code session
- ( ) Claude Code Usage -- key usable only within Claude Code sessions
- ( ) Both -- current behavior (default, for backward compatibility)
Why this matters (trust and adoption)
This is fundamentally a trust feature, and trust is the actual blocker to
adoption here, not preference. Users evaluating whether to enable a key at
all are weighing a binary: enable it and accept it may be applied somewhere
they didn't intend, or don't enable it and lose the benefit of auto-load
entirely. Right now the only guard available is disabling auto-load, which
throws out the convenience it exists to provide.
A explicit, verifiable scope guarantee flips that calculus. It lets users
extend a key to Claude Code (or to API-only automation) with confidence
about exactly where it can and cannot be applied, rather than having to take
it on faith. That confidence is what turns a cautious, auto-load-disabled
user into an active one -- it's a retention and adoption lever for Anthropic,
not just a nice-to-have for the security-conscious minority.
Without this, some users will keep keys disabled indefinitely rather than
risk them being applied somewhere they didn't intend -- which is a worse
outcome for both the user (loses functionality) and Anthropic (loses usage)
than shipping the scoping control.