Function getAnthropicApiKeyWithSource

src/utils/auth.ts:292–422

(
  opts: { skipRetrievingKeyFromApiKeyHelper?: boolean } = {},
)

}

export function getAnthropicApiKeyWithSource(
  opts: { skipRetrievingKeyFromApiKeyHelper?: boolean } = {},
): {
  key: null | string
  source: ApiKeySource
} {
  // --bare: hermetic static-key auth. Only direct env keys or apiKeyHelper from
  // the --settings flag are read. Never touches keychain, config file, or
  // approval lists. 3P (Bedrock/Vertex/Foundry) uses provider creds, not this
  // path.
  if (isBareMode()) {
    const directApiKey = getDirectApiKeyEnvValue()
    if (directApiKey) {
      return {
        key: directApiKey,
        source: getDirectApiKeyEnvVarName() ?? 'ANTHROPIC_API_KEY',
      }
    }
    if (getConfiguredApiKeyHelper()) {
      return {
        key: opts.skipRetrievingKeyFromApiKeyHelper
          ? null
          : getApiKeyFromApiKeyHelperCached(),
        source: 'apiKeyHelper',
      }
    }
    return { key: null, source: 'none' }
  }

  // On homespace, don't use direct API-key env overrides (use Console key instead)
  // https://anthropic.slack.com/archives/C08428WSLKV/p1747331773214779
  const apiKeyEnv = isRunningOnHomespace()
    ? undefined
    : getDirectApiKeyEnvValue()
  const directApiKeySource = getDirectApiKeyEnvVarName() ?? 'ANTHROPIC_API_KEY'

  // Always check for direct environment variable when the user ran claude --print.
  // This is useful for CI, etc.
  if (preferThirdPartyAuthentication() && apiKeyEnv) {
    return {
      key: apiKeyEnv,
      source: directApiKeySource,
    }
  }

  if (isEnvTruthy(process.env.CI) || process.env.NODE_ENV === 'test') {
    // Check for API key from file descriptor first
    const apiKeyFromFd = getApiKeyFromFileDescriptor()
    if (apiKeyFromFd) {
      return {
        key: apiKeyFromFd,
        source: 'ANTHROPIC_API_KEY',
      }
    }

    if (
      !apiKeyEnv &&
      !process.env.NCODE_OAUTH_TOKEN &&