Authentication¶
kew dispatches Claude Code autonomously — it runs without a human in the loop. This has authentication requirements that differ from interactive Claude Code use.
Official Codex CLI login¶
The official Codex runner authenticates on the host through the CLI's own login
cache or operating-system keychain. Run codex login, then verify with
codex login status. kew checks that official CLI login but never reads,
copies, mounts, prints, or records its credential. HOME remains available;
OPENAI_API_KEY, CODEX_ACCESS_TOKEN, unrelated provider credentials, GitHub
tokens, and AWS credentials are removed. There is no token-env fallback.
API key required¶
Set ANTHROPIC_API_KEY in your environment before running kew:
For persistent setup, add it to your shell profile (~/.zshrc, ~/.bashrc) or a .env file that you source before running kew.
Do not use Pro/Max subscription OAuth¶
Warning: Do not use Claude Pro or Max subscription OAuth tokens for autonomous dispatch. Using subscription OAuth for automated/programmatic access may violate Anthropic's Terms of Service, which restrict subscription accounts to interactive, human-supervised use.
Autonomous dispatch — where kew runs Claude Code in a loop without a human in the loop — requires an API account with an ANTHROPIC_API_KEY, not a subscription OAuth session.
See Anthropic's usage policies and legal page for the authoritative terms.
Economic rationale¶
API pricing is consumption-based: you pay per token, only for what you use. This is the correct model for autonomous workloads because:
- Costs scale with actual work done, not a flat subscription rate
- No risk of hitting subscription rate limits that could silently stall your queue
- Auditable spend — every dispatch run logs token usage and cost, and you can set per-run budget caps with
agent.max_budget_usdinkew.toml
For most repositories, a single dispatch run costs $0.50–$5 depending on issue complexity. Use kew run --dry-run to preview without spending anything.
Which credential a sandboxed dispatch needs¶
A contained dispatch authenticates from the host environment only — ~/.claude is deliberately not mounted, so CLI login state can never reach a container. Which env var kew requires (and forwards) is keyed by the resolved runner, not by "whatever credential happens to be set":
| Runner | Required in the environment | How to get one |
|---|---|---|
claude-code |
ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN |
An API key from console.anthropic.com; claude setup-token mints the OAuth token — but see the subscription warning above before using it for autonomous dispatch |
opencode, pi, hermes |
OPENROUTER_API_KEY |
openrouter.ai/keys |
codex |
(none; official CLI login is host-only) | External container execution fails closed |
lemonade |
(none — its endpoint is host-local, so it cannot be contained) | — |
Only the resolved runner's own names are forwarded into the container (see security.md) — a contained opencode run never receives your Anthropic credentials, and a contained claude run never receives your OpenRouter key. Values travel by name: kew passes -e ANTHROPIC_API_KEY, never the secret itself, so no credential value lands in an argv, a log, the run history, or the audit ledger.
If the resolved runner's credential is missing, kew refuses the dispatch before launching the container and tells you which var to export — a container that comes up "Not logged in" burns a dispatch for nothing. You can check the whole path ahead of time with: