termdeck
A key takes priority over the sign-in
ANTHROPIC_API_KEY is checked before the subscription credential, and ANTHROPIC_AUTH_TOKEN before that too. Neither announces itself. The session simply runs on whichever was found first.
Claude Code fix: Claude Code uses an API key instead of your subscription
Claude Code is using an API key, not your login
Credentials are read in a fixed order and the first one found wins. A key set months ago in a settings file beats the login you completed this morning, silently, and on a different bill.
Comes from Claude Code.
Diagnosis
What it actually is
The key does not have to be in your shell
Claude Code reads its own env block out of ~/.claude/settings.json and settings.local.json. A machine configured that way looks credential-free to anything inspecting only the environment, while the CLI on the same disk is perfectly signed in.
A service inherits neither shell nor terminal
Something installed as a service never sees the shell where a key was exported. That is how one machine bills an API key interactively and uses the subscription from a service, on the same account, on the same day.
Check
Confirm it before you fix it
| Run this | What a good answer looks like |
|---|---|
claude auth status | Prints the auth method it settled on. This is the direct answer, and it beats whatever you remember configuring. |
grep -n ANTHROPIC ~/.claude/settings.json ~/.claude/settings.local.json | Finds a key set in the settings files rather than the shell. Both carry an env block and both are read. |
env | grep ANTHROPIC | The other half. The process environment wins over the settings files, so a value here explains a machine that ignores both. |
Every command here has been run on a real machine. Termdeck answers the same questions for every machine you have connected, without opening a terminal on any of them.
Fix
Cheapest thing first
1. Remove the credential you did not mean to use
Unset it in the shell, or delete the line from the settings env block, then start a new session. An open shell keeps the value it started with.
2. Keep the two apart on purpose
Where both are genuinely wanted, put the key in the environment of the one thing that needs it rather than in a settings file every session reads.
3. Confirm with the status output
It names the method actually in use. Anything else is inference.
Not this
What will not help
Signing in again to override the key
A sign-in writes the subscription credential, which is still read after the key. The key keeps winning until it is gone.
FAQ
Claude Code uses an API key instead of your subscription, answered
Which credential does Claude Code prefer?
An API key first, then an auth token, then the subscription login. The first one present is the one used.
Why did my usage appear on the API bill?
Because a key was found ahead of the subscription credential, and the session ran on it without saying so.
Does a key in a settings file affect a service too?
Yes, because the CLI reads that file itself. What a service does not inherit is the shell environment.
Claude Code, Codex and Grok in one browser console