stablyai/orca · error · Error

This Claude launch defines explicit Anthropic auth environme

Error message

This Claude launch defines explicit Anthropic auth environment variables. Remove those overrides before using a managed Claude account.

What it means

Thrown when claudeAuth.stripAuthEnv is true (managed Claude account in use, which needs to remove ambient Anthropic env) AND hasClaudeAuthEnvConflict(args.env) is true. The conflict list per environment.ts: ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, CLAUDE_CODE_OAUTH_TOKEN, AWS_BEARER_TOKEN_BEDROCK, or an ANTHROPIC_CUSTOM_HEADERS value matching /authorization|x-api-key|api-key|bearer/i. Refusing the launch prevents a managed account from being silently overridden by user-supplied credentials.

Source

Thrown at src/main/ipc/pty.ts:4560

            providerSession: args.resumeProviderSession,
            target: codexSelectionTarget,
            launchEnv: args.env,
            workspacePath: cwd
          })
      const codexResumeLaunch = codexResumePreparation
        ? await resolveCodexResumeLaunch(args.command, codexResumePreparation)
        : noCodexResumeLaunch(preAdoptedStablePane ? undefined : args.command)
      const codexResumeHome = codexResumeLaunch.codexResumeHome
      // Why: the drop still applies here, but this controller's result has no field for
      // notifyResumeUnavailable — runtime/relay panes start fresh without the notice.
      const launchCommand = codexResumeLaunch.command
      const claudeAuth =
        isClaudeLaunch && prepareClaudeAuth ? await prepareClaudeAuth(codexSelectionTarget) : null
      if (isClaudeLaunch && isClaudeAuthSwitchInProgress()) {
        throw new Error('A Claude account switch is in progress. Try again after it finishes.')
      }
      if (claudeAuth?.stripAuthEnv && hasClaudeAuthEnvConflict(args.env)) {
        throw new Error(
          'This Claude launch defines explicit Anthropic auth environment variables. Remove those overrides before using a managed Claude account.'
        )
      }

      const shouldPersistHostSessionBinding = args.persistHostSessionBinding === true
      let hostSessionBinding: {
        store: NonNullable<typeof store>
        worktreeId: string
        tabId: string
        leafId: string
        expectedSourceBinding?: PtyBindingSourceExpectation
      } | null = null
      if (shouldPersistHostSessionBinding) {
        if (
          !store ||
          typeof args.worktreeId !== 'string' ||
          typeof args.tabId !== 'string' ||
          !isValidTerminalTabId(args.tabId) ||

View on GitHub (pinned to 1136503c6a)

Solutions

1. Remove the Anthropic auth env vars (ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, CLAUDE_CODE_OAUTH_TOKEN, AWS_BEARER_TOKEN_BEDROCK) from the launch env or shell profile, then retry.
2. Strip auth-like values from ANTHROPIC_CUSTOM_HEADERS (no 'authorization', 'x-api-key', 'api-key', or 'bearer' tokens).
3. Switch the launch to an unmanaged account so the explicit env is honored instead of conflicting with managed credentials.
4. Use the terminal's env override UI to unset the conflicting keys for this pane only.

Example fix

// before — ambient env conflicts with managed Claude account
const env = {
  ...process.env,
  ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY // inherited from .zshrc
}
await spawnPty({ command: 'claude', env })

// after — drop the conflicting vars before a managed launch
import { CLAUDE_AUTH_ENV_VARS } from '../claude-accounts/environment'
const env = { ...process.env }
for (const key of CLAUDE_AUTH_ENV_VARS) delete env[key]
delete env.ANTHROPIC_CUSTOM_HEADERS
await spawnPty({ command: 'claude', env })

import { CLAUDE_AUTH_ENV_VARS, hasClaudeAuthEnvConflict } from '../claude-accounts/environment'

function stripClaudeAuthEnvForManagedLaunch(env: Record<string, string>): Record<string, string> {
  if (!hasClaudeAuthEnvConflict(env)) return env
  const next = { ...env }
  for (const key of CLAUDE_AUTH_ENV_VARS) delete next[key]
  delete next.ANTHROPIC_CUSTOM_HEADERS
  return next
}

function isClaudeAuthEnvConflict(err: unknown): boolean {
  return (
    err instanceof Error &&
    err.message === 'This Claude launch defines explicit Anthropic auth environment variables. Remove those overrides before using a managed Claude account.'
  )
}

try {
  await spawnPty(args)
} catch (err) {
  if (isClaudeAuthEnvConflict(err)) {
    surfaceUserAction('Remove ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN / CLAUDE_CODE_OAUTH_TOKEN / AWS_BEARER_TOKEN_BEDROCK and auth-like ANTHROPIC_CUSTOM_HEADERS from the pane env, then retry.')
    return
  }
  throw err
}

When it happens

Trigger: Spawning a Claude launch with env containing one of CLAUDE_AUTH_ENV_VARS (or auth-like custom headers) while a managed Claude account is selected. prepareClaudeAuth returned stripAuthEnv:true, so the launch is being routed through managed credentials that the explicit env would override.

Common situations: User has ANTHROPIC_API_KEY set in shell profile (.zshrc/.bashrc) and selects a managed Claude account; workspace .env with ANTHROPIC_AUTH_TOKEN loaded into the terminal env; AWS_BEARER_TOKEN_BEDROCK from a Bedrock config; ANTHROPIC_CUSTOM_HEADERS carrying a bearer token.

Related errors

• A Claude account switch is in progress. Try again after it f
• token is required
• token is required
• The Codex account credentials for this session are temporari
• The selected Codex account credentials are temporarily unava

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/2730d5879108b1a4. Report an issue: GitHub.