You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
AuthArea: what it touches
ImprovementsKind: in v2.1.248,
ImprovementsSection of the release
What
When logging into a Console profile is refused, the refusal now carries a specific class such as a workload-identity environment quad, a third-party provider, an API key in the environment, a foreign profile, or a custom credentials path, and a table decides which of those are hard refusals.
Details
The ANTHROPIC_API_KEY refusal now only fires when the credential actually in use came from that environment variable.
Profile names are validated: only A-Z a-z 0-9 _ . - are allowed, and . and .. are rejected.
Evidence
Console profile login refused: non-dispatching env API key present
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeFixed the recommended Console sign-in in /login failing with an OAuth error before showing a sign-in URL on machines where it can't be used…
