Summary
Today the Anthropic provider authenticates only with a pasted API key (or the ANTHROPIC_API_KEY env var). Many users already pay for a Claude Pro/Max subscription and would like to authenticate with that account directly — via Anthropic's OAuth flow — instead of buying separate prepaid API credits. This request asks for an optional OAuth/subscription auth method on the Anthropic provider, surfaced as an auth_method choice the way the Bedrock provider already does it.
Motivation
A Claude Pro/Max subscription and API access are billed separately: the subscription covers the web/desktop chat apps, while the API requires its own prepaid credits on console.anthropic.com. Users who already subscribe reasonably expect to reuse that entitlement.
Sibling tools in this space (Claude Code, OpenCode, and others) already offer a "Claude Pro/Max" OAuth login, so there is clear user demand and an established UX pattern to follow.
It lowers the barrier to trying OpenWorker with Claude: no second billing relationship to set up.
Current behavior (traced in source)
The Anthropic provider exposes a single auth field and resolves a key from only two places:
coworker/providers/registry.py — the anthropic descriptor declares one field:
ProviderField("api_key", "Anthropic API key", secret=True, placeholder="sk-ant-…")
There is no auth_method selector (unlike the bedrock descriptor, which offers api_key / profile / iam choices).
coworker/providers/anthropic_provider.py — resolve_api_key() resolves from the ANTHROPIC_API_KEY env var or the SecretStore provider:anthropic profile {api_key}, and nothing else.
So there is currently no path to authenticate with a subscription account.
Proposal
Add an optional OAuth/subscription auth method to the Anthropic provider, modeled on patterns OpenWorker already ships:
auth_method choice on the Anthropic descriptor (mirrors Bedrock's existing show_when-driven switching):
api_key (default) — the current behavior, unchanged.
subscription — "Sign in with your Claude account" via Anthropic's OAuth flow.
Reuse the existing OAuth broker for the handshake. The README notes OpenWorker already runs "a small service that brokers OAuth handshakes for connectors." The same broker pattern can host the Anthropic authorization-code + PKCE flow and return tokens to the local app.
Token lifecycle in the local SecretStore. Store the access/refresh tokens under the provider:anthropic profile; refresh automatically; inject as a Bearer token in the Authorization header (Anthropic's completions API accepts the OAuth token as a Bearer token). This keeps everything local-first, consistent with how connector tokens and model keys are already stored.
Keep the API-key path fully intact for users who prefer prepaid credits or need a service account.
Important caveat: Anthropic Terms of Service
Anthropic's terms state that Claude Pro/Max subscription tokens are intended for use with official Anthropic clients only. Routing subscription credentials through a third-party agent may violate those terms and could put a user's account at risk. Any implementation should therefore:
Surface a clear, explicit consent warning before a user connects via subscription OAuth, linking to Anthropic's current terms.
Make the API-key path the default and the subscription path an explicit opt-in.
Track Anthropic's published guidance — if/when Anthropic offers a sanctioned third-party/subscription API path, prefer that.
This caveat is the main reason to treat the feature as opt-in-with-warning rather than a drop-in default, and it's worth an explicit maintainer decision on whether to ship it at all given the ToS risk.
Alternatives considered
Status quo (API key only). Works, but forces a second billing relationship on subscribers.
AWS Bedrock / Vertex AI. Already supported and lets users run Claude in their own cloud account (vision-capable), but that's cloud-account billing, not subscription reuse, and requires AWS/GCP setup.
Reusing Claude Code's local OAuth credentials. Some tools read Claude Code's on-disk tokens to avoid a separate login. This inherits the same ToS concern and couples OpenWorker to another app's credential storage, so it's less clean than a first-party flow.
Environment / context
OpenWorker, latest main (registry.py / anthropic_provider.py read from github.com/andrewyng/openworker on 2026-08-02).
Related: the Bedrock descriptor's auth_method + show_when fields are a ready-made template for the UI switching.
Summary
Today the Anthropic provider authenticates only with a pasted API key (or the ANTHROPIC_API_KEY env var). Many users already pay for a Claude Pro/Max subscription and would like to authenticate with that account directly — via Anthropic's OAuth flow — instead of buying separate prepaid API credits. This request asks for an optional OAuth/subscription auth method on the Anthropic provider, surfaced as an auth_method choice the way the Bedrock provider already does it.
Motivation
A Claude Pro/Max subscription and API access are billed separately: the subscription covers the web/desktop chat apps, while the API requires its own prepaid credits on console.anthropic.com. Users who already subscribe reasonably expect to reuse that entitlement.
Sibling tools in this space (Claude Code, OpenCode, and others) already offer a "Claude Pro/Max" OAuth login, so there is clear user demand and an established UX pattern to follow.
It lowers the barrier to trying OpenWorker with Claude: no second billing relationship to set up.
Current behavior (traced in source)
The Anthropic provider exposes a single auth field and resolves a key from only two places:
coworker/providers/registry.py — the anthropic descriptor declares one field:
ProviderField("api_key", "Anthropic API key", secret=True, placeholder="sk-ant-…")
There is no auth_method selector (unlike the bedrock descriptor, which offers api_key / profile / iam choices).
coworker/providers/anthropic_provider.py — resolve_api_key() resolves from the ANTHROPIC_API_KEY env var or the SecretStore provider:anthropic profile {api_key}, and nothing else.
So there is currently no path to authenticate with a subscription account.
Proposal
Add an optional OAuth/subscription auth method to the Anthropic provider, modeled on patterns OpenWorker already ships:
auth_method choice on the Anthropic descriptor (mirrors Bedrock's existing show_when-driven switching):
api_key (default) — the current behavior, unchanged.
subscription — "Sign in with your Claude account" via Anthropic's OAuth flow.
Reuse the existing OAuth broker for the handshake. The README notes OpenWorker already runs "a small service that brokers OAuth handshakes for connectors." The same broker pattern can host the Anthropic authorization-code + PKCE flow and return tokens to the local app.
Token lifecycle in the local SecretStore. Store the access/refresh tokens under the provider:anthropic profile; refresh automatically; inject as a Bearer token in the Authorization header (Anthropic's completions API accepts the OAuth token as a Bearer token). This keeps everything local-first, consistent with how connector tokens and model keys are already stored.
Keep the API-key path fully intact for users who prefer prepaid credits or need a service account.
Important caveat: Anthropic Terms of Service
Anthropic's terms state that Claude Pro/Max subscription tokens are intended for use with official Anthropic clients only. Routing subscription credentials through a third-party agent may violate those terms and could put a user's account at risk. Any implementation should therefore:
Surface a clear, explicit consent warning before a user connects via subscription OAuth, linking to Anthropic's current terms.
Make the API-key path the default and the subscription path an explicit opt-in.
Track Anthropic's published guidance — if/when Anthropic offers a sanctioned third-party/subscription API path, prefer that.
This caveat is the main reason to treat the feature as opt-in-with-warning rather than a drop-in default, and it's worth an explicit maintainer decision on whether to ship it at all given the ToS risk.
Alternatives considered
Status quo (API key only). Works, but forces a second billing relationship on subscribers.
AWS Bedrock / Vertex AI. Already supported and lets users run Claude in their own cloud account (vision-capable), but that's cloud-account billing, not subscription reuse, and requires AWS/GCP setup.
Reusing Claude Code's local OAuth credentials. Some tools read Claude Code's on-disk tokens to avoid a separate login. This inherits the same ToS concern and couples OpenWorker to another app's credential storage, so it's less clean than a first-party flow.
Environment / context
OpenWorker, latest main (registry.py / anthropic_provider.py read from github.com/andrewyng/openworker on 2026-08-02).
Related: the Bedrock descriptor's auth_method + show_when fields are a ready-made template for the UI switching.