What
When Claude Code talks to Anthropic models on Google Vertex, the HTTP client now blanks out Authorization (and X-Api-Key, unless a check passes) so Google's own auth client is the only thing supplying credentials. If auth resolution is skipped, your own Authorization value is passed through instead.
Details
- The blanking happens through default headers set at client construction time, so it applies to every request that client makes.
- Where credential resolution is bypassed, the caller-supplied value travels as a separate
wireAuthorizationfield rather than being dropped. - The client's internal auth promise now has a no-op catch, so a failed credential fetch no longer surfaces as an unhandled promise rejection.
Evidence
wireAuthorization
Strings lifted out of the shipped bundle, so the claim above can be checked against them.