When interpolating ${VAR} into HTTP hook headers, the CLI now checks whether the variable's value looks like a credential using a heuristic. If it does, interpolation is refused and a warning is logged, even if the variable is listed in allowedEnvVars, unless it's separately allow-listed.
Names in the bundleallowedEnvVars
Documented inclaude-code/hooks
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up allowedEnvVars, on Hooks reference.
| `headers` | no | Additional HTTP headers as key-value pairs. Values support environment variable interpolation using `$VAR_NAME` or `${VAR_NAME}` syntax. Only variables listed in `allowedEnvVars` are resolved |hooks see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up allowedEnvVars, on Hooks reference.