Anthropic "Sign in" bills extra usage, not the plan, and is disallowed for third-party apps by Anthropic's terms

Nobody has claimed this yet.

## Problem

I may be wrong, so please read this as a question. The "Claude Pro/Max" OAuth login on the Welcome screen seems to use a flow that Anthropic's terms do not allow, and it no longer uses the plan's limits anyway.

ThinkRail has no Anthropic-specific code here. The server's [login bridge](https://github.com/JetBrains/thinkrail/blob/a3b91d7e168514930c33d6e8edbe302b280b2c70/packages/server/src/auth/providerLogin.ts#L46-L105) calls pi's `runtime.login()` and passes the prompts to the UI. The actual flow is implemented in pi (`@earendil-works/pi-ai` 0.84.3), which:

- runs an OAuth flow against `claude.ai/oauth/authorize` with [Claude Code's own client id](https://github.com/earendil-works/pi/blob/v0.84.3/packages/ai/src/auth/oauth/anthropic.ts#L29-L36), hidden behind base64, and asks for the `user:sessions:claude_code` scope;
- [stores and refreshes the token](https://github.com/earendil-works/pi/blob/v0.84.3/packages/ai/src/auth/oauth/anthropic.ts#L317-L359) itself;
- sends [Claude Code's identity headers](https://github.com/earendil-works/pi/blob/v0.84.3/packages/ai/src/api/anthropic-messages.ts#L936-L938) on every OAuth request (`user-agent: claude-cli/`, `x-app: cli`, the `claude-code-20250219` beta);
- injects ["You are Claude Code, Anthropic's official CLI for Claude."](https://github.com/earendil-works/pi/blob/v0.84.3/packages/ai/src/api/anthropic-messages.ts#L1014) as the first system block;
- [renames tools to Claude Code's names](https://github.com/earendil-works/pi/blob/v0.84.3/packages/ai/src/api/anthropic-messages.ts#L76-L105) under a comment reading "Stealth mode: Mimic Claude Code's tool naming exactly".

Anthropic's [Claude Code legal page](https://code.claude.com/docs/en/legal-and-compliance) says:

> Anthropic does not permit third-party developers to offer Claude.ai login into their own applications, or to route requests through Free, Pro, or Max plan credentials on behalf of their users. Moreover, developers may not collect, store, or intermediate Claude.ai credentials or session tokens — sign-in to a Claude account must complete through Anthropic's own flow.

pi's flow breaks each of these rules, and ThinkRail is the third party offering the login.

### What pi's tracker says

- January 2026: Anthropic began [rejecting pi's OAuth requests](https://github.com/earendil-works/pi/issues/581) with "This credential is only authorized for use with Claude Code". The maintainer [removed `/login`](https://github.com/earendil-works/pi/issues/581#issuecomment-3727189970), then [restored it the same day](https://github.com/earendil-works/pi/issues/581#issuecomment-3727203823) ("I lied, /login is back in. Update. YOLO."). That is when the tool renaming was added. His [own summary](https://github.com/earendil-works/pi/issues/602#issuecomment-3730299547): "it still works, but you are at risk of getting your account banned."
- April 2026: after the April 4 billing change the API [responds with](https://github.com/earendil-works/pi/issues/3372) "Third-party apps now draw from your extra usage, not your plan limits." The maintainer [replied](https://github.com/earendil-works/pi/issues/3372#issuecomment-4273458406): "we don't provide work arounds. as per the message as that's a ToS violation, you'll need to enable extra usage and get billed by token."
- July 2026: two users asked pi to [stop sending Claude Code's User-Agent](https://github.com/earendil-works/pi/issues/6392) and to [add Claude Code's billing marker](https://github.com/earendil-works/pi/issues/6421) so that plan limits apply again. Both issues were closed automatically and neither change was made.

### What the user gets today

Based on pi's issue tracker and code (I have not tested this against a real account): Anthropic recognises pi's requests as third-party despite the Claude Code headers, and bills them per token from the account's extra-usage balance. If extra usage is disabled, requests fail. pi 0.84.3 ships a [TUI warning](https://github.com/earendil-works/pi/blob/v0.84.3/packages/coding-agent/src/modes/interactive/interactive-mode.ts#L236) that says exactly this, plus an ["Anthropic extra usage" toggle](https://github.com/earendil-works/pi/blob/v0.84.3/packages/coding-agent/src/modes/interactive/components/settings-selector.ts#L142). A [July report on pi 0.80.3](https://github.com/earendil-works/pi/issues/6421) shows the same behaviour, and pi's requests have not changed since. ThinkRail shows no such warning.

So "not permitted" means two different things. For users, Anthropic accepts third-party use as pay-per-token: its April email said "To keep using third-party harnesses with your Claude plan, enable extra usage." For developers, offering the login or storing the tokens is still not allowed. The result for a ThinkRail user who clicks "Sign in" is an unofficial flow that spends extra-usage money at API rates while the UI says it uses their plan.

That claim is in our own text. The Welcome screen's [provider card](https://github.com/JetBrains/thinkrail/blob/a3b91d7e168514930c33d6e8edbe302b280b2c70/apps/web/src/panels/ProvidersSettings.tsx#L189-L191) is headed "Sign in with a subscription" with "Use your existing Claude, ChatGPT, or Copilot plan — no API key needed." For Claude, the word "plan" is wrong by itself, whatever happens to the row.

### How others handle it

Zed's [`claude-code-acp`](https://github.com/zed-industries/claude-code-acp) wraps `@anthropic-ai/claude-agent-sdk`, which runs Anthropic's unmodified Claude Code. Claude Code performs the login, keeps the token and makes the API calls; Zed touches neither. That matches the legal page's exception for "signing in to the unmodified Claude Code binary", and Zed's [June 2026 update](https://zed.dev/blog/anthropic-subscription-changes) says Anthropic confirmed that ACP and Agent SDK usage keeps working on subscriptions.

JetBrains Air offers only "Anthropic Console (API Billing)", with a banner saying plan authentication is not permitted by Anthropic's terms. It does not offer OAuth and does not claim that a plan is used, which is the honest choice given the above.

## Proposed solution

Stop offering Anthropic OAuth: set `canOAuth` to false for the `anthropic` row where the [provider report is built](https://github.com/JetBrains/thinkrail/blob/a3b91d7e168514930c33d6e8edbe302b280b2c70/packages/server/src/auth/providerStatus.ts#L51-L66), keep `canApiKey`, record the decision in `auth/SPEC.md`, cover it with a test, and reword the subscription card. API-key auth via Claude Console and JetBrains AI via Central are unaffected.

## Alternatives considered

- Keep the row behind an explicit "unsupported, bills extra usage, may violate Anthropic's terms" acknowledgement.
- Do what Zed does. This conflicts with the decision to run only pi, with no second runtime.

Happy to be corrected if someone has an authoritative source saying pi's approach is permitted.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Start with packages/server/src/auth/providerStatus.ts, auth/SPEC.md, and apps/web/src/panels/ProvidersSettings.tsx. Confirm how the Anthropic provider reports OAuth and API-key support, then review the existing auth test coverage. Done means Anthropic OAuth is not offered, API-key auth remains available, the specification records the decision, tests cover it, and the subscription card no longer claims plan usage.

Written by the indexing model from the issue text.