You'll noticeTier: how much it should matter to you
4Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
TelemetryArea: what it touches
New FeaturesKind: in v2.1.246,
What probably matters to youSection of the release
What
Before sending telemetry, Claude Code now compares the credential it holds against the endpoint host and, if they do not match, removes the auth headers with the reason misrouted_credential. Pointing OpenTelemetry metrics at a third-party collector no longer leaks your Anthropic credential to it.
Details
Applies whenever OTel metrics export runs; there is no flag to turn it off.
The BigQuery metrics exporter checks in three places: it skips export entirely when the metrics endpoint is misrouted, skips the organization metrics_enabled lookup when that endpoint is misrouted, and otherwise sends without auth headers rather than failing outright.
The metrics_enabled request moved to auth: "none" with headers attached explicitly, and raises a new error when no usable credential exists.
Evidence
credential withheld: this telemetry endpoint is not the host it belongs to
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
