Skip to main content
claude setup-token creates a long-lived OAuth token for your Claude subscription. You usually export it as CLAUDE_CODE_OAUTH_TOKEN, which puts the token in every agent’s environment. With OneCLI, you store the token once in the gateway instead. Agents call api.anthropic.com as usual, and the gateway adds the token to each request.

​
What you will set up

  • A Claude subscription token stored as an Anthropic secret in OneCLI
  • Claude Code running through the OneCLI gateway with onecli run -- claude
  • Requests to api.anthropic.com that carry your token, without the token in the agent’s environment

​
Before you start

  • A Claude Pro, Max, Team, or Enterprise plan. The free plan doesn’t include Claude Code, so it can’t create a token.
  • Claude Code installed. Check with claude --version.
  • A running OneCLI instance. For a local one, run:
The dashboard runs on localhost:10254 and the gateway on port 10255.

​
Steps

1

Generate the token

Run:
A browser window opens. Sign in to the Claude account that has your plan and approve. The terminal prints a token that starts with sk-ant-oat. Copy all of it, on one line. The token is valid for one year, and the command doesn’t save it anywhere.
Treat the token like a password. Anyone who has it can use your Claude plan.
2

Store it in OneCLI

In the dashboard, open your agent’s Models page, click Add LLM key, and choose Anthropic. Paste the token into Secret value and click Add Secret.OneCLI sees the sk-ant-oat prefix and injects the token as Authorization: Bearer {token}. API keys go in the x-api-key header instead. See Anthropic for both options.
3

Remove the token from your shell

If you exported the token before, remove it so it stays only in OneCLI:
Also delete any matching export lines from ~/.zshrc or ~/.bashrc.
4

Run Claude Code through the gateway

Sign the CLI in with your OneCLI API key from the dashboard, then start Claude Code:
You’ll see onecli: gateway connected. Starting claude.... onecli run sets the proxy and CA certificate and removes ANTHROPIC_API_KEY from the environment. On each request to api.anthropic.com, the gateway replaces the Authorization header with your stored token. See Coding agents for all onecli run options.

​
Use the token in other agents

Any agent whose traffic goes through the gateway gets the same token on Anthropic requests:

​
FAQ

It runs the same browser sign-in as /login and prints a one-year OAuth token for your Claude subscription. Usage counts against your plan, not API billing.
An environment variable is readable by the agent and by every process it starts. In OneCLI, the token stays in the gateway, and you can revoke or rotate it in one place.
Anthropic rejects requests and the key shows Key rejected on the Models page. Run claude setup-token again and update the secret with the pencil icon.
Yes. Paste a Claude Console key (sk-ant-api...) into the same field. OneCLI injects it as x-api-key. See Anthropic.

​
Next steps