.env.example

# Required: OAuth access token from your Claude Code login.
# Either variable name works; CLAUDE_OAUTH_TOKEN is checked first.
CLAUDE_OAUTH_TOKEN=
# CLAUDE_CODE_OAUTH_TOKEN=

# Strongly recommended: refresh token. Without it the proxy will stop
# working when the access token expires (typically every 8 hours).
CLAUDE_OAUTH_REFRESH_TOKEN=
# CLAUDE_CODE_OAUTH_REFRESH_TOKEN=

# Optional tuning.
# MAX_CONCURRENT_REQUESTS=5
# SUBPROCESS_TIMEOUT=120
# CLAUDE_CLI_VERSION=2.1.109
# CLAUDE_OAUTH_CLIENT_ID=9d1c250a-e61b-44d9-88ed-5944d1962f5e

# Where the token state (with refreshed tokens) is persisted inside the
# container. The provided docker-compose mounts ./data for this.
# TOKEN_STATE_FILE=/data/token_state.json

# ── Direct API mode (EXPERIMENTAL, FRAGILE — read the README) ─────
# When enabled, the proxy exposes a second set of routes under /direct/*
# that bypass the Claude Code CLI and hit api.anthropic.com directly with
# the OAuth bearer token. This skips CLI subprocess overhead but sends
# requests without the client-attestation hash the CLI computes per
# request (cch, in x-anthropic-billing-header). Anthropic does not
# validate that hash today, but likely will — at which point accounts
# sending unsigned or forged traffic may be banned. Opt in knowing that.
# ENABLE_DIRECT_API=false
# DIRECT_API_ENDPOINT=https://api.anthropic.com/v1/messages
# DIRECT_API_MAX_TOKENS=4096