What
The plugin eval CLI checks it can actually authenticate before running any cases, so a run fails fast with an explanation instead of partway through. It engages only for first-party auth in env-quad mode with none of ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN or ANTHROPIC_UNIX_SOCKET set.
Details
- A failed setup or token exchange aborts the run with a message.
- Failures that look transient (HTTP 5xx, 429, 408, or DNS and socket errors) are downgraded to a warning and the run continues.
- 401 or 403 adds advice to check the federation rule and set
ANTHROPIC_WORKSPACE_ID.
Evidence
workload identity federation could not obtain an access token
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up ANTHROPIC_AUTH_TOKEN, on Connect Claude Code to an LLM gateway.
* **Amazon Bedrock, Google Cloud's Agent Platform, or Claude Platform on AWS**: add `ANTHROPIC_AUTH_TOKEN` after the block. Claude Code sends it to the gateway as an `Authorization: Bearer` header. For a credential in a different scheme or…llm-gateway-connect see the edit
Confirmed since
Anthropic's documentation has since written up ANTHROPIC_API_KEY, on permission-policies.
-H "x-api-key: $ANTHROPIC_API_KEY" \managed-agents/permission-policies see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up ANTHROPIC_API_KEY, on permission-policies.