Configured Force Claudeai Login

Restrict Claude Code authentication exclusively to Claude.ai accounts, ensuring consistent user experience and billing through the Claude.ai platform.

When to Use This Setting

Apply this setting when you need to:

• Ensure all team members authenticate through Claude.ai for unified subscription-based billing
• Prevent accidental use of Anthropic Console API keys that would incur separate usage-based charges
• Standardize the login experience across your organization using Claude.ai accounts

Consider alternatives when:

• Your organization requires API-based billing through Anthropic Console accounts
• You need to support both Claude.ai and Console authentication methods simultaneously

Quick Start

Configuration

Copy
name: configured-force-claudeai-login
type: setting
category: authentication

Example Application

Copy
claude setting:apply configured-force-claudeai-login

Example Output

Setting applied successfully. Configuration changes:
- forceLoginMethod: claudeai
- Authentication: Claude.ai accounts only
- Console login: disabled

Core Concepts

Authentication Restriction Overview

Aspect	Details
Method	Claude.ai OAuth login only
Billing	Claude.ai subscription-based
Console Access	Blocked at login prompt
User Experience	Consistent Claude.ai flow
Session Management	Claude.ai token lifecycle

Login Flow Architecture

┌──────────────┐     ┌──────────────────┐
│  User Starts │     │  Auth Gateway    │
│  Claude Code │────>│                  │
│              │     │  forceLoginMethod │
│              │     │  = "claudeai"    │
│              │     │                  │
│              │     │  ┌────────────┐  │
│              │     │  │ Claude.ai  │──── ALLOWED
│              │     │  │ Login      │  │
│              │     │  └────────────┘  │
│              │     │  ┌────────────┐  │
│              │     │  │ Console    │──── BLOCKED
│              │     │  │ Login      │  │
│              │     │  └────────────┘  │
└──────────────┘     └──────────────────┘

Configuration

Parameter	Type	Default	Description
forceLoginMethod	string	none	Set to "claudeai" to restrict to Claude.ai
loginTimeout	number	300	Seconds before login prompt times out
sessionDuration	string	"24h"	Duration of authenticated session
reauthPrompt	boolean	true	Prompt for re-auth on session expiry
fallbackBehavior	string	"block"	Action when Claude.ai auth unavailable

Best Practices

1. Communicate the Change to Teams - Before applying this setting organization-wide, notify all developers that Console login will be blocked. Provide clear instructions for creating Claude.ai accounts if they currently use Console credentials only.

2. Apply at the Organization Level - Set this configuration in the organization-wide settings file rather than per-project. This ensures consistent enforcement regardless of which repository a developer is working in.

3. Verify Subscription Coverage - Ensure all team members have active Claude.ai subscriptions before enforcing this setting. Users without subscriptions will be completely locked out of Claude Code after this restriction is applied.

4. Monitor Login Failures - Track authentication failures after applying the restriction. A spike in failures indicates team members attempting to use Console credentials and needing guidance on switching to Claude.ai accounts.

5. Plan for Service Accounts - If your CI/CD pipelines use Claude Code with Console API keys, create exceptions or separate configurations for non-interactive service accounts that cannot use Claude.ai OAuth login.

Common Issues

1. Users locked out after applying setting - Team members with only Console accounts cannot authenticate. Provide a migration path: create Claude.ai accounts first, then apply the restriction after confirming all users have access.

2. CI/CD pipelines failing - Automated systems cannot perform OAuth login. Use a separate settings profile for CI/CD that allows API key authentication, or configure a dedicated service account.

3. OAuth redirect failures in remote environments - Claude.ai login requires a browser redirect. In SSH or container environments, use claude auth --token with a pre-generated Claude.ai token instead of the interactive OAuth flow.