{"version":"2.1.233","anchor":"auth-preflight-before-plugin-eval-runs","canonical_anchor":"auth-preflight-before-plugin-eval-runs","heading":"Auth preflight before plugin eval runs","tier":"notice","area":"Plugins","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.233\/e\/auth-preflight-before-plugin-eval-runs","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.233","markdown":"### Auth preflight before plugin eval runs\n\nPlugin eval checks your credentials up front and fails fast instead of dying partway through a run.\n\n**What**\n\nThe plugin eval CLI checks it can actually authenticate before running any cases, so a run fails fast with an explanation instead of partway through. It engages only for first-party auth in `env-quad` mode with none of `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN` or `ANTHROPIC_UNIX_SOCKET` set.\n\n**Details**\n\n- A failed setup or token exchange aborts the run with a message.\n- Failures that look transient (HTTP 5xx, 429, 408, or DNS and socket errors) are downgraded to a warning and the run continues.\n- 401 or 403 adds advice to check the federation rule and set `ANTHROPIC_WORKSPACE_ID`.\n\n**Evidence**\n\n`workload identity federation could not obtain an access token`\n\n- Area: Plugins\n- Names: `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN`, `ANTHROPIC_UNIX_SOCKET`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}