What
- The function that determines the active authentication type now returns both the auth type and whether the API key came from an
apiKeyHelper, and treats a key sourced this way as present even if its actual value is empty or falsy. - A new
api_key_helpercase was added to the logic that decides model-catalog access policy, so it now goes through the sameallow_model_catalogpolicy check that was previously only applied tonot_claude_ai_auth. The no-auth-method case also gained API-key-specific served-catalog handling.
Why
This ensures that when an organization supplies API keys via an apiKeyHelper script rather than a static key, Claude Code correctly recognizes that an API key is in use and applies the same model-catalog access policy as it does for other authentication methods.
Names in the bundleapiKeyHelper
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Added since
A small documentation edit on Claude apps gateway deployment and operations touched a line naming apiKeyHelper after this was published.
| Startup exits with `Administrator policy requires a Cloud gateway sign-in on this machine` | The developer's environment sets `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN`, their settings configure an [`apiKeyHelper`](/docs/en/settings-r…claude-apps-gateway-deploy see the edit
Confirmed since
Anthropic's documentation has since written up apiKeyHelper, on Extend Claude with skills.
* A session that doesn't use a sign-in stored by `/login`, such as one that authenticates with an API key, or one where `ANTHROPIC_AUTH_TOKEN`, `CLAUDE_CODE_OAUTH_TOKEN`, or an `apiKeyHelper` script supplies the credentialskills see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up apiKeyHelper, on Extend Claude with skills.