claude-code - 💡(How to fix) Fix Silent ANTHROPIC_API_KEY precedence shadows Max subscription auth [1 comments, 2 participants]

What

When both ANTHROPIC_API_KEY (env var) and a Claude Pro/Max OAuth login are present on the same machine, Claude Code silently uses the API key. There is no warning at session start, no notice in claude /status until the user explicitly checks, and no one-time prompt asking which auth method to use.

Impact

Users who set ANTHROPIC_API_KEY for a single project's scripts (e.g. a cron job, a CI step, a tool that needs programmatic access) end up unknowingly running all subsequent interactive Claude Code sessions against the API tier instead of their Max subscription. They're paying twice for usage their subscription already covers.

In my own case, I burned ~$20 of API credit across two interactive coding sessions that should have been covered by my Max plan. The fix (an alias claude='env -u ANTHROPIC_API_KEY claude') is one line, but only if you know to look for it. Most users won't until they see the bill.

Why this matters

The boundary between "scripts use API tier" and "interactive use is covered by Max" is reasonable and industry-standard. But the silent precedence in Claude Code converts users into pay-as-you-go customers without informing them. This produces revenue from users' confusion rather than their stated intent.

Suggested fix (any one of these would resolve it)

1. First-run prompt: when Claude Code detects both ANTHROPIC_API_KEY AND an active OAuth login, prompt once: "We detected both an API key and a logged-in subscription. Which billing source should interactive sessions use? (API key / Subscription / Ask each session)". Persist the choice in ~/.claude/config.json.
2. Status banner: show a single line at session start, e.g. Auth: API key (ANTHROPIC_API_KEY env). Run /login to switch to your logged-in subscription. Make it dismissable but visible by default.
3. Documentation: add a clear note in the Claude Code billing/auth docs explaining precedence and the env -u workaround. Currently this is buried.

Reproduction

1. export ANTHROPIC_API_KEY=sk-... in shell profile
2. claude /login to a Max account
3. claude /status — confirms both, but doesn't say which is active for billing
4. Run an interactive session — billed to API, not Max

Workaround

alias claude='env -u ANTHROPIC_API_KEY claude'

Adding this to ~/.zshrc causes interactive sessions to ignore the env var and use OAuth/Max instead. Scripts that explicitly read os.getenv("ANTHROPIC_API_KEY") continue to work because the env var is still set in the shell, just stripped from the claude invocation.

Why a one-time prompt rather than always-prefer-Max

I'm not asking for "always prefer subscription" because there are legit reasons to keep the current behaviour (e.g. an org-issued API key with shared billing should override personal Max). The ask is just make the choice visible and explicit, not silent.