[BUG] Custom API key detection prompt renders a hardcoded `sk-ant-` prefix regardless of the actual value

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

I had ANTHROPIC_API_KEY=ollama set from a local Ollama setup. Claude Code detected it and showed:

Detected a custom API key in your environment
ANTHROPIC_API_KEY: sk-ant-...ollama
Do you want to use this API key?

The value is just ollama. There's no sk-ant- in it. Looks like the prefix is hardcoded in the display string instead of coming from the value.

Same thing in LLM-Red-Team/kimi-cc#44, where someone pointing Claude Code at Moonshot got sk-ant-...p0Zv3SKL4J9dhp1ECd5m for a key that wouldn't have that prefix.

Two problems with this. The prompt is asking me to decide whether to use a key, but it renders anything as a well-formed Anthropic key, so there's nothing to decide on. And the tail reveal looks like ~20 characters with no length check, which is more of a real key than needs showing.

The auth-conflict warning handles this correctly, for what it's worth. If you already have a claude.ai session it says "Both claude.ai and ANTHROPIC_API_KEY set" and just names the variable. Only the detection prompt does this.

What Should Happen?

The masked value should be built from the actual key, not a hardcoded prefix. Something like <first 12 chars>...<last 4>, so ollama renders as visibly not a key and a real key renders as sk-ant-api03...aBcD.

Reveal from the prefix rather than the tail. The prefix is format metadata; the tail is entropy and is the part that uniquely identifies a key, which makes it the worse half to disclose. Four characters is a reasonable cap.

Below some minimum length the tail shouldn't be revealed at all, since a short value gets shown in full. Rendering it as clearly-not-a-key is the useful outcome there, not hiding it.

The bigger issue is the first one though. The prompt is asserting the value is an Anthropic key without having checked, so the user is being asked to approve a credential based on a property the display invented.

Error Messages/Logs

Steps to Reproduce

1. Set ANTHROPIC_API_KEY to any value that isn't an Anthropic key
2. Launch claude with a config dir that has no claude.ai session
3. Observe the detection prompt

ANTHROPIC_API_KEY=ollama CLAUDE_CONFIG_DIR="$HOME/.claude-test" claude

Prompt shows ANTHROPIC_API_KEY: sk-ant-...ollama.

The separate config dir matters. With an existing claude.ai login you get the auth-conflict warning path instead and the detection prompt never fires.

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.233 (native install, also reproduced on 2.1.217)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Other

Additional Information

Reproduced on 2.1.217 and 2.1.233, so not a recent regression. The kimi-cc report is from August 2025 and shows the same output, which suggests it's long-standing.

Found this incidentally: I had ANTHROPIC_API_KEY=ollama left over from pointing Claude Code at a local Ollama server. Worth noting because that's a common way to end up with a non-key value in that variable, and the prompt gives no signal that what it detected isn't a real credential.

<img width="761" height="595" alt="Image" src="https://github.com/user-attachments/assets/5002a0c6-5ddd-4961-9b7e-3abf02ad1888" />