fix: use Bearer auth for ANTHROPIC_AUTH_TOKEN and add ANTHROPIC_MODEL#197
Merged
jamiepine merged 2 commits intospacedriveapp:mainfrom Feb 25, 2026
Merged
fix: use Bearer auth for ANTHROPIC_AUTH_TOKEN and add ANTHROPIC_MODEL#197jamiepine merged 2 commits intospacedriveapp:mainfrom
jamiepine merged 2 commits intospacedriveapp:mainfrom
Conversation
- Add new AnthropicAuthPath::AuthToken variant for proxy tokens - Track is_auth_token in ProviderConfig when key comes from ANTHROPIC_AUTH_TOKEN - Pass is_auth_token through build_anthropic_request to apply_auth_headers - AuthToken uses Authorization: Bearer without Claude Code identity headers - Add ANTHROPIC_MODEL env var to set all anthropic/* routes - Update tests for new AuthToken variant Fixes 403 errors when using ANTHROPIC_AUTH_TOKEN with corporate proxies. Closes discussion in spacedriveapp#135 about auth header mismatch. Note: CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC is deferred for future work.
WalkthroughAdded environment-based routing support for ANTHROPIC_MODEL environment variable to override anthropic/* routing configuration settings. Remaining changes consist of formatting adjustments in authentication tests and indentation corrections across utility files with no functional impact. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~15 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
src/llm/anthropic/auth.rs (1)
96-107:⚠️ Potential issue | 🟠 MajorUpdate detect_auth_path test calls for new signature.
The unit tests still call
detect_auth_pathwith one argument, so the test module won’t compile.🧪 Update test calls
- detect_auth_path("sk-ant-oat01-abc123"), + detect_auth_path("sk-ant-oat01-abc123", false), AnthropicAuthPath::OAuthToken ); } @@ - detect_auth_path("sk-ant-api03-xyz789"), + detect_auth_path("sk-ant-api03-xyz789", false), AnthropicAuthPath::ApiKey ); } @@ - detect_auth_path("some-random-key"), + detect_auth_path("some-random-key", false), AnthropicAuthPath::ApiKey ); }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/llm/anthropic/auth.rs` around lines 96 - 107, Tests failing because detect_auth_path now requires a second boolean parameter is_auth_token; update all test calls to pass the appropriate is_auth_token value. Find usages in the test module that call detect_auth_path(token) and change them to detect_auth_path(token, true) or detect_auth_path(token, false) depending on whether the test intends the token to come from ANTHROPIC_AUTH_TOKEN; ensure test cases asserting AnthropicAuthPath::AuthToken use true and other cases use false.src/llm/anthropic/params.rs (1)
54-107:⚠️ Potential issue | 🟠 MajorAuthToken shouldn’t trigger Claude Code preamble/tool normalization.
is_oauthnow treatsAuthTokenlike OAuth, which injects Claude Code identity behavior and tool renaming. That contradicts the “bearer-only, no identity” intent forANTHROPIC_AUTH_TOKEN. Keep OAuth behavior only forOAuthToken(and mirror inmodel.rs).🔧 Suggested change
- let is_oauth = auth_path == AnthropicAuthPath::OAuthToken || auth_path == AnthropicAuthPath::AuthToken; + let is_oauth = auth_path == AnthropicAuthPath::OAuthToken;🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/llm/anthropic/params.rs` around lines 54 - 107, The code sets is_oauth by comparing auth::detect_auth_path(...) to both AnthropicAuthPath::OAuthToken and AnthropicAuthPath::AuthToken, which causes AuthToken to receive OAuth-only behavior; change the is_oauth check in build_anthropic_request to be true only when auth::detect_auth_path(...) == AnthropicAuthPath::OAuthToken so ANTHROPIC_AUTH_TOKEN remains "bearer-only, no identity", and adjust any related logic that branches on is_oauth (e.g., build_system_prompt and build_tools calls) accordingly; also mirror this fix in the corresponding logic in model.rs where detect_auth_path is evaluated.
♻️ Duplicate comments (1)
src/llm/model.rs (1)
362-363: Align AuthToken handling with non‑OAuth tool remap.Same concern as noted in
src/llm/anthropic/params.rs: if AuthToken is meant to be bearer-only, it shouldn’t trigger Claude Code tool remapping here either.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/llm/model.rs` around lines 362 - 363, The check that sets is_oauth currently treats AnthropicAuthPath::AuthToken the same as OAuthToken; change the logic so only AnthropicAuthPath::OAuthToken makes is_oauth true (i.e., remove the AuthToken branch) so bearer-only AuthToken does not trigger Claude Code tool remapping; update the condition using anthropic_request.auth_path and the AnthropicAuthPath::OAuthToken enum variant accordingly (leave any other uses of AnthropicAuthPath::AuthToken untouched).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/config.rs`:
- Around line 2078-2086: The current boolean anthropic_is_auth_token only
becomes true when no TOML key is present, so a TOML anthropic_key that
references env:ANTHROPIC_AUTH_TOKEN still selects x-api-key; update the logic to
also detect when toml.llm.anthropic_key explicitly references the environment
variable ANTHROPIC_AUTH_TOKEN (e.g., the raw string contains or parses as
"env:ANTHROPIC_AUTH_TOKEN" or resolve_env_value indicates an env-ref) and treat
that case as using auth token; modify the condition around
anthropic_is_auth_token (and the duplicate logic at the later block around the
2218-2229 occurrence) to check both the absence of a resolved TOML key and the
presence of an env reference to ANTHROPIC_AUTH_TOKEN before consulting
std::env::var.
---
Outside diff comments:
In `@src/llm/anthropic/auth.rs`:
- Around line 96-107: Tests failing because detect_auth_path now requires a
second boolean parameter is_auth_token; update all test calls to pass the
appropriate is_auth_token value. Find usages in the test module that call
detect_auth_path(token) and change them to detect_auth_path(token, true) or
detect_auth_path(token, false) depending on whether the test intends the token
to come from ANTHROPIC_AUTH_TOKEN; ensure test cases asserting
AnthropicAuthPath::AuthToken use true and other cases use false.
In `@src/llm/anthropic/params.rs`:
- Around line 54-107: The code sets is_oauth by comparing
auth::detect_auth_path(...) to both AnthropicAuthPath::OAuthToken and
AnthropicAuthPath::AuthToken, which causes AuthToken to receive OAuth-only
behavior; change the is_oauth check in build_anthropic_request to be true only
when auth::detect_auth_path(...) == AnthropicAuthPath::OAuthToken so
ANTHROPIC_AUTH_TOKEN remains "bearer-only, no identity", and adjust any related
logic that branches on is_oauth (e.g., build_system_prompt and build_tools
calls) accordingly; also mirror this fix in the corresponding logic in model.rs
where detect_auth_path is evaluated.
---
Duplicate comments:
In `@src/llm/model.rs`:
- Around line 362-363: The check that sets is_oauth currently treats
AnthropicAuthPath::AuthToken the same as OAuthToken; change the logic so only
AnthropicAuthPath::OAuthToken makes is_oauth true (i.e., remove the AuthToken
branch) so bearer-only AuthToken does not trigger Claude Code tool remapping;
update the condition using anthropic_request.auth_path and the
AnthropicAuthPath::OAuthToken enum variant accordingly (leave any other uses of
AnthropicAuthPath::AuthToken untouched).
ℹ️ Review info
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (6)
src/api/providers.rssrc/config.rssrc/llm/anthropic/auth.rssrc/llm/anthropic/params.rssrc/llm/manager.rssrc/llm/model.rs
src/config.rs
Outdated
Comment on lines
2078
to
2086
| // Track whether ANTHROPIC_AUTH_TOKEN is being used (for Bearer auth) | ||
| let anthropic_is_auth_token = toml | ||
| .llm | ||
| .anthropic_key | ||
| .as_deref() | ||
| .and_then(resolve_env_value) | ||
| .is_none() | ||
| && std::env::var("ANTHROPIC_API_KEY").is_err() | ||
| && std::env::var("ANTHROPIC_AUTH_TOKEN").is_ok(); |
There was a problem hiding this comment.
Config env:ANTHROPIC_AUTH_TOKEN won’t set is_auth_token.
anthropic_is_auth_token only flips when no TOML key is present, so a config that references env:ANTHROPIC_AUTH_TOKEN will still use x‑api‑key headers. Consider detecting that env reference explicitly (or adding a config flag).
🔧 Suggested change
- let anthropic_is_auth_token = toml
- .llm
- .anthropic_key
- .as_deref()
- .and_then(resolve_env_value)
- .is_none()
- && std::env::var("ANTHROPIC_API_KEY").is_err()
- && std::env::var("ANTHROPIC_AUTH_TOKEN").is_ok();
+ let anthropic_key_raw = toml.llm.anthropic_key.as_deref();
+ let anthropic_is_auth_token =
+ matches!(anthropic_key_raw, Some("env:ANTHROPIC_AUTH_TOKEN"))
+ || (anthropic_key_raw.is_none()
+ && std::env::var("ANTHROPIC_API_KEY").is_err()
+ && std::env::var("ANTHROPIC_AUTH_TOKEN").is_ok());Also applies to: 2218-2229
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@src/config.rs` around lines 2078 - 2086, The current boolean
anthropic_is_auth_token only becomes true when no TOML key is present, so a TOML
anthropic_key that references env:ANTHROPIC_AUTH_TOKEN still selects x-api-key;
update the logic to also detect when toml.llm.anthropic_key explicitly
references the environment variable ANTHROPIC_AUTH_TOKEN (e.g., the raw string
contains or parses as "env:ANTHROPIC_AUTH_TOKEN" or resolve_env_value indicates
an env-ref) and treat that case as using auth token; modify the condition around
anthropic_is_auth_token (and the duplicate logic at the later block around the
2218-2229 occurrence) to check both the absence of a resolved TOML key and the
presence of an env reference to ANTHROPIC_AUTH_TOKEN before consulting
std::env::var.
![tembo[bot]](https://avatars.githubusercontent.com/in/1223475?s=60&v=4){kind=small}
src/llm/anthropic/params.rs
Outdated
| ) -> AnthropicRequest { | ||
| let is_oauth = auth::detect_auth_path(api_key) == AnthropicAuthPath::OAuthToken; | ||
| let auth_path = auth::detect_auth_path(api_key, is_auth_token); | ||
| let is_oauth = auth_path == AnthropicAuthPath::OAuthToken || auth_path == AnthropicAuthPath::AuthToken; |
Contributor
There was a problem hiding this comment.
If AuthToken is meant to be “Bearer auth without Claude Code identity”, grouping it under is_oauth will also inject the Claude Code system preamble + tool-name normalization. I think is_oauth should stay strictly for the OAuth path.
Suggested change
| let is_oauth = auth_path == AnthropicAuthPath::OAuthToken || auth_path == AnthropicAuthPath::AuthToken; | |
| let is_oauth = auth_path == AnthropicAuthPath::OAuthToken; |
src/llm/model.rs
Outdated
Comment on lines
362
to
363
| let is_oauth = anthropic_request.auth_path == crate::llm::anthropic::AnthropicAuthPath::OAuthToken | ||
| || anthropic_request.auth_path == crate::llm::anthropic::AnthropicAuthPath::AuthToken; |
Contributor
There was a problem hiding this comment.
AuthToken seems like it should behave like the plain API key path (no Claude Code identity/tool renames). Including it in is_oauth makes us reverse-map tool names even though we probably didn’t normalize them.
Suggested change
| let is_oauth = anthropic_request.auth_path == crate::llm::anthropic::AnthropicAuthPath::OAuthToken | |
| || anthropic_request.auth_path == crate::llm::anthropic::AnthropicAuthPath::AuthToken; | |
| let is_oauth = | |
| anthropic_request.auth_path == crate::llm::anthropic::AnthropicAuthPath::OAuthToken; |
src/config.rs
Outdated
| pub api_key: String, | ||
| pub name: Option<String>, | ||
| /// Whether the token came from ANTHROPIC_AUTH_TOKEN (uses Bearer auth) | ||
| pub is_auth_token: bool, |
Contributor
There was a problem hiding this comment.
Nice to have the provenance tracked explicitly. One thing to watch when this lands on main: adding a new required field means every ProviderConfig { ... } literal needs to set it (most should be is_auth_token: false). Might be worth a quick rg 'ProviderConfig \{' sweep on main to avoid a surprise compile break during merge resolution.
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
src/config.rs (1)
2533-2560: Add regression tests forANTHROPIC_MODELprecedence and shape.Please add tests that cover:
ANTHROPIC_MODELpopulates all five anthropic routes,SPACEBOT_CHANNEL_MODELandSPACEBOT_WORKER_MODELstill override their respective routes afterward, and- empty / prefixed
ANTHROPIC_MODELinput behavior.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/config.rs` around lines 2533 - 2560, Add unit tests for RoutingConfig env var precedence and input shape: create tests that set ANTHROPIC_MODEL to a sample value and assert routing.channel/branch/worker/compactor/cortex are all "anthropic/<value>" (test that RoutingConfig::default() + the env reading logic in the function that assigns routing values produces the five anthropic routes), then set SPACEBOT_CHANNEL_MODEL and SPACEBOT_WORKER_MODEL afterwards in the same test (or a second test) and assert they override routing.channel and routing.worker respectively while the other routes remain anthropic-prefixed; also add tests for empty and prefixed ANTHROPIC_MODEL inputs (e.g., empty string and a value already starting with "anthropic/") to assert resulting routing entries are correct (no double prefixing or unexpected empties). Ensure tests manipulate environment variables (std::env::set_var/remove_var) and invoke the code path that builds RoutingConfig (reference RoutingConfig, ANTHROPIC_MODEL, SPACEBOT_CHANNEL_MODEL, SPACEBOT_WORKER_MODEL, and the code block that formats "anthropic/{}") so behaviors and precedence are validated.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/config.rs`:
- Around line 2542-2554: Trim and validate the ANTHROPIC_MODEL env var before
using it to build routes: read std::env::var("ANTHROPIC_MODEL"), call .trim()
and if the result is empty do not modify routing; then strip any leading
"anthropic/" prefix (e.g. remove a leading case-sensitive "anthropic/" if
present) so you don't double-prefix, optionally reject values containing path
separators beyond a simple model token, and finally compose the routes using the
sanitized model (e.g. format!("anthropic/{}", sanitized_model)) and assign to
routing.channel, routing.branch, routing.worker, routing.compactor, and
routing.cortex.
---
Nitpick comments:
In `@src/config.rs`:
- Around line 2533-2560: Add unit tests for RoutingConfig env var precedence and
input shape: create tests that set ANTHROPIC_MODEL to a sample value and assert
routing.channel/branch/worker/compactor/cortex are all "anthropic/<value>" (test
that RoutingConfig::default() + the env reading logic in the function that
assigns routing values produces the five anthropic routes), then set
SPACEBOT_CHANNEL_MODEL and SPACEBOT_WORKER_MODEL afterwards in the same test (or
a second test) and assert they override routing.channel and routing.worker
respectively while the other routes remain anthropic-prefixed; also add tests
for empty and prefixed ANTHROPIC_MODEL inputs (e.g., empty string and a value
already starting with "anthropic/") to assert resulting routing entries are
correct (no double prefixing or unexpected empties). Ensure tests manipulate
environment variables (std::env::set_var/remove_var) and invoke the code path
that builds RoutingConfig (reference RoutingConfig, ANTHROPIC_MODEL,
SPACEBOT_CHANNEL_MODEL, SPACEBOT_WORKER_MODEL, and the code block that formats
"anthropic/{}") so behaviors and precedence are validated.
ℹ️ Review info
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
src/config.rssrc/llm/anthropic/auth.rssrc/llm/manager.rssrc/llm/model.rs
✅ Files skipped from review due to trivial changes (2)
- src/llm/manager.rs
- src/llm/model.rs
🚧 Files skipped from review as they are similar to previous changes (1)
- src/llm/anthropic/auth.rs
Comment on lines
+2542
to
+2554
| if let Ok(anthropic_model) = std::env::var("ANTHROPIC_MODEL") { | ||
| // ANTHROPIC_MODEL sets all anthropic/* routes to the specified model | ||
| let channel = format!("anthropic/{}", anthropic_model); | ||
| let branch = format!("anthropic/{}", anthropic_model); | ||
| let worker = format!("anthropic/{}", anthropic_model); | ||
| let compactor = format!("anthropic/{}", anthropic_model); | ||
| let cortex = format!("anthropic/{}", anthropic_model); | ||
| routing.channel = channel; | ||
| routing.branch = branch; | ||
| routing.worker = worker; | ||
| routing.compactor = compactor; | ||
| routing.cortex = cortex; | ||
| } |
There was a problem hiding this comment.
Normalize and validate ANTHROPIC_MODEL before composing routes.
This block currently accepts empty/whitespace values and double-prefixes values like anthropic/claude-*, which can produce invalid route strings and runtime routing failures.
🔧 Proposed fix
- if let Ok(anthropic_model) = std::env::var("ANTHROPIC_MODEL") {
- // ANTHROPIC_MODEL sets all anthropic/* routes to the specified model
- let channel = format!("anthropic/{}", anthropic_model);
- let branch = format!("anthropic/{}", anthropic_model);
- let worker = format!("anthropic/{}", anthropic_model);
- let compactor = format!("anthropic/{}", anthropic_model);
- let cortex = format!("anthropic/{}", anthropic_model);
- routing.channel = channel;
- routing.branch = branch;
- routing.worker = worker;
- routing.compactor = compactor;
- routing.cortex = cortex;
- }
+ if let Ok(anthropic_model_raw) = std::env::var("ANTHROPIC_MODEL") {
+ // ANTHROPIC_MODEL sets all anthropic/* routes to the specified model.
+ let model = anthropic_model_raw
+ .trim()
+ .trim_start_matches("anthropic/");
+ if !model.is_empty() {
+ let route = format!("anthropic/{model}");
+ routing.channel = route.clone();
+ routing.branch = route.clone();
+ routing.worker = route.clone();
+ routing.compactor = route.clone();
+ routing.cortex = route;
+ }
+ }📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| if let Ok(anthropic_model) = std::env::var("ANTHROPIC_MODEL") { | |
| // ANTHROPIC_MODEL sets all anthropic/* routes to the specified model | |
| let channel = format!("anthropic/{}", anthropic_model); | |
| let branch = format!("anthropic/{}", anthropic_model); | |
| let worker = format!("anthropic/{}", anthropic_model); | |
| let compactor = format!("anthropic/{}", anthropic_model); | |
| let cortex = format!("anthropic/{}", anthropic_model); | |
| routing.channel = channel; | |
| routing.branch = branch; | |
| routing.worker = worker; | |
| routing.compactor = compactor; | |
| routing.cortex = cortex; | |
| } | |
| if let Ok(anthropic_model_raw) = std::env::var("ANTHROPIC_MODEL") { | |
| // ANTHROPIC_MODEL sets all anthropic/* routes to the specified model. | |
| let model = anthropic_model_raw | |
| .trim() | |
| .trim_start_matches("anthropic/"); | |
| if !model.is_empty() { | |
| let route = format!("anthropic/{model}"); | |
| routing.channel = route.clone(); | |
| routing.branch = route.clone(); | |
| routing.worker = route.clone(); | |
| routing.compactor = route.clone(); | |
| routing.cortex = route; | |
| } | |
| } |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@src/config.rs` around lines 2542 - 2554, Trim and validate the
ANTHROPIC_MODEL env var before using it to build routes: read
std::env::var("ANTHROPIC_MODEL"), call .trim() and if the result is empty do not
modify routing; then strip any leading "anthropic/" prefix (e.g. remove a
leading case-sensitive "anthropic/" if present) so you don't double-prefix,
optionally reject values containing path separators beyond a simple model token,
and finally compose the routes using the sanitized model (e.g.
format!("anthropic/{}", sanitized_model)) and assign to routing.channel,
routing.branch, routing.worker, routing.compactor, and routing.cortex.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds the missing piece from #135: proper handling of
ANTHROPIC_AUTH_TOKENto use Bearer authentication instead ofx-api-keyheader. This fixes 403 errors when using corporate Anthropic-compatible proxies.Also adds
ANTHROPIC_MODELenv var as requested by @pjv.Changes
Auth Header Fix
When
ANTHROPIC_AUTH_TOKENis used (detected by checking if the key came from that env var vsANTHROPIC_API_KEY), the request now uses:Authorization: Bearer <token>headerThis matches how Claude Code itself handles the distinction between API keys and auth tokens.
New Auth Path Variant
Added
AnthropicAuthPath::AuthTokenalongside existingApiKeyandOAuthToken:ApiKey→x-api-keyheader (native Anthropic)OAuthToken→Authorization: Bearer+ identity headers (Claude Code OAuth)AuthToken(new) →Authorization: Beareronly (proxy tokens)ANTHROPIC_MODEL Env Var
Sets all
anthropic/*routes at once. Example:This sets channel, branch, worker, compactor, and cortex all to
anthropic/claude-opus-4-6.Files Changed
src/llm/anthropic/auth.rs- NewAuthTokenvariant, updateddetect_auth_pathandapply_auth_headerssrc/config.rs-is_auth_tokentracking inProviderConfig,ANTHROPIC_MODELsupportsrc/llm/anthropic/params.rs- Threadis_auth_tokenthrough request buildingsrc/llm/model.rs- Passis_auth_tokenfrom provider configsrc/api/providers.rs,src/llm/manager.rs- Addis_auth_token: falseto test providersTesting
Added 3 new unit tests for
AuthToken:auth_token_uses_bearer_headerauth_token_has_no_identity_headersauth_token_has_streaming_beta_but_no_oauth_betaNotes
CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFICwas requested but deferred as it requires more infrastructure workANTHROPIC_API_KEYusers are unaffectedFixes
ANTHROPIC_AUTH_TOKENNote
This change adds support for auth tokens via the
ANTHROPIC_AUTH_TOKENenvironment variable with proper Bearer authentication, and introduces theANTHROPIC_MODELenvironment variable to configure all Anthropic-based LLM process models in one place. The implementation detects auth token usage and automatically handles the appropriate authentication headers (Bearer without Claude Code identity), while maintaining backward compatibility with existing API key configuration.Written by Tembo for commit 5b9074e. This will update automatically on new commits.