CClaude Code Guide中文

Claude Code authentication

Claude Code supports several authentication paths for individuals and teams. Pick the method that matches your billing model, then verify the active credential before debugging tool or model errors.

Last verified
Applies to
Claude Code 2.1.x. CLI spellings were checked on local version 2.1.198; official docs may describe newer 2.1.x behavior.
Verification method
Local version and auth help were checked without reading credential values. Login, renewal, organization locks, cloud providers, and credential precedence are documentation-based; no account flow was changed.
Official sources
AuthenticationCLI referenceChangelog

Reproducible practice

Identify the active authentication path without exposing credentials

Separate subscription, API key, gateway, and cloud-provider state before changing login or billing configuration.

Prerequisites

  • A trusted terminal with Claude Code installed.
  • Permission to inspect status but not print token values.
  • The expected organization and billing path recorded separately.

Steps

  1. Record client state

    Capture the executable and version before interpreting an authentication error.

    Step 1
    command -v claude
claude --version
claude auth status --text

  2. Check only credential selectors

    Report whether selectors are set while redacting every value.

    Step 2
    for name in CLAUDE_CODE_USE_BEDROCK CLAUDE_CODE_USE_VERTEX CLAUDE_CODE_USE_FOUNDRY ANTHROPIC_AUTH_TOKEN ANTHROPIC_API_KEY CLAUDE_CODE_OAUTH_TOKEN; do
  if printenv "$name" >/dev/null; then printf '%s=<set>\n' "$name"; fi
done

  3. Compare status with the intended provider

    Use `/status` in an interactive session only if account policy allows it; do not paste identifiers into tickets.

  4. Change one layer only

    Renew `/login`, unset an unintended selector, or ask an administrator about organization locks. Do not rotate unrelated credentials.

Expected result

The active authentication class and intended billing path agree, or one specific precedence or policy mismatch is identified without exposing a secret.

Validation

  • Re-run `claude auth status --text` after one change.
  • Confirm a selector is absent or present without printing its value.
  • Record account-dependent checks as pending until an authorized request succeeds.

Failure handling

Browser callback fails

Use the documented copy-code flow for SSH, WSL, or containers rather than exporting a token into chat.

Unexpected billing path

Check documented credential precedence and remove only the unintended selector.

Cleanup or rollback

  • Restore only the selector changed during diagnosis if the intended provider stops working.
  • Do not delete keychain or credential files manually; use supported login and logout flows.

Boundaries and when not to use it

  • Status output can contain organization or account identifiers; redact before sharing.
  • Cloud IAM, SSO, gateway, and organization-lock behavior cannot be proven from a local help screen.

Individual login options

After installation, run `claude` and complete browser login on first launch. You can authenticate with a Claude subscription, Claude for Teams or Enterprise, Claude Console, or a configured cloud provider.

Check auth from the terminal
claude auth login
claude auth status --text
/status

Team authentication models

Organizations usually choose Claude for Teams or Enterprise, Claude Console API billing, a self-hosted gateway, or a cloud provider integration. Distribute the same method in onboarding docs.

Claude for Teams

Self-service plan with centralized billing and admin tools.

CI and automation tokens

Interactive browser login is not ideal for pipelines. Use setup-token or documented API-key flows, and store secrets in your CI secret manager.

CommandDescription
claude setup-tokenGenerate a long-lived OAuth token for scripts and CI.
claude auth login --consoleSign in with Anthropic Console for API billing.
/logoutLog out and reset first-launch setup state.
Use a setup token in CI
export CLAUDE_CODE_OAUTH_TOKEN=your-token
claude -p "Summarize failing tests"

Credential precedence and renewal

When multiple credentials exist, Claude Code follows a defined precedence order. Cloud provider credentials and environment keys can override a subscription login if both are present.

Where auth fits in the stack

Authentication problems often masquerade as MCP, permissions, or model errors. Verify credentials before changing project configuration.

Authentication checklist

Related topics

SetupSettingsCI/CDTroubleshooting