[BUG] Claude Code silently authenticates from ~/.config/anthropic credentials file, billing API credits while an active Max subscription goes unused

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Claude Code will authenticate from ~/.config/anthropic/credentials/default.json — the credentials file written by the ant CLI — in preference to prompting for login, with no indication anywhere in the UI that it is doing so.

That file holds a Console/API OAuth credential (it carries an organization_id and a workspace_id). So requests are billed to API credits, not to the Max subscription on the same account, and usage appears in the Console under source "Console" rather than under any
named API key.

Three things make this hard to detect:

1. claude auth status (default JSON output) reports {"loggedIn": false, "authMethod": "none"} while requests are succeeding. Only claude auth status --text reveals the actual source, as "Profile: credentials-file · user_oauth · profile default".
2. claude auth logout does not clear that file, so logging out and back in appears to change nothing and gives a false all-clear.
3. There is no API key involved — it is OAuth — so the usual checks (ANTHROPIC_API_KEY, apiKeyHelper, keys in settings.json) all come back clean. I checked all of those first and they told me nothing.

In my case this drew $59 of API credits in a single day while the Max 5x subscription on the same account sat at 11% consumed and was capable of serving every one of those requests. The account's own extra-usage setting was disabled (hasExtraUsageEnabled: false) and did not prevent it.

The credentials file was created on 6 June by running ant auth login. Any user who has ever run that command appears to be exposed to this.

What Should Happen?

Either of these would have prevented the charge:

1. Claude Code should prefer an active Claude subscription login over a Console credentials file found on disk.
2. Failing that, it should state clearly at session start which credential it resolved and what that credential bills to — e.g. "Authenticated via credentials-file (Console workspace) — usage will be billed to API credits, not your subscription."

claude auth logout should also clear, or at minimum warn about, credential sources outside the keychain. And claude auth status should not report loggedIn: false while successfully authenticating requests — the two output modes should agree.

Error Messages/Logs

$ claude auth status
{
  "loggedIn": false,
  "authMethod": "none",
  "apiProvider": "firstParty"
}

$ claude auth status --text
Profile: credentials-file · user_oauth · profile default

# ~/.config/anthropic/configs/default.json  (created 6 June 2026)
version                  = 1.0
authentication.type      = user_oauth
authentication.client_id = <redacted>
organization_id          = <redacted>
workspace_id             = <redacted>

# After the fix:
$ claude auth status --text
Login method: Claude Max account
Organization: <redacted>
Email: <redacted>

Steps to Reproduce

1. On an account with an active Claude Max subscription, run ant auth login (the Anthropic CLI) and complete the OAuth flow. This writes ~/.config/anthropic/configs/default.json and ~/.config/anthropic/credentials/default.json.
2. Ensure Claude Code has no subscription login in the keychain — claude auth logout, or let the stored token lapse.
3. Run claude and issue any prompt. It works, with no login prompt and no warning.
4. Run claude auth status — reports {"loggedIn": false, "authMethod": "none"}.
5. Run claude auth status --text — reports "Profile: credentials-file · user_oauth · profile default".
6. Check Console usage: the requests appear under source "Console", billed to API credits. Subscription usage is unchanged.

Workaround that fixed it:

mv ~/.config/anthropic/credentials/default.json \
~/.config/anthropic/credentials/default.json.disabled
claude auth login --claudeai
claude auth status --text # now reads: Login method: Claude Max account

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.223 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Other

Additional Information

One thing I could not test: whether Claude Code prefers the credentials file over a valid subscription login, or only falls back to it when no subscription login is present. I fixed both at once (moved the file aside AND logged in), so I only established the fall-through case. Which of the two it is changes the blast radius considerably, and you can determine it from the code far faster than I can from outside.

Possibly related but not a duplicate: #81281 concerns ~/.claude/.credentials.json and a stale OAuth token. This is a different file (~/.config/anthropic/) written by a different tool.

I have a support ticket open on the billing side separately; this issue is about the product behaviour, not the refund.