From 01e260ce1700bddccf811780c729dd4a872842f3 Mon Sep 17 00:00:00 2001 From: Oracle Public Cloud User Date: Mon, 20 Apr 2026 03:20:33 +0000 Subject: [PATCH] fix(usage): send OAuth Bearer + anthropic-beta header for /v1/messages probe Follow-up to #21. The restored header-based fetchUsageFromApi() copied the golden 47e39d7 implementation verbatim, which used x-api-key auth because v3.0.0 targeted API-key users (sk-ant-api03-*). Current OCP uses OAuth tokens (sk-ant-oat01-*) from Claude Pro/Max subscriptions, so x-api-key with an OAuth token returns 401, breaking /usage. Claude Code cli.js alignment evidence: - For OAuth calls, headers are: Authorization: Bearer anthropic-beta: oauth-2025-04-20 - Constant qJ="oauth-2025-04-20" in cli.js - Multiple call sites confirmed (e.g. /v1/files upload, /v1/sessions) Fix: replace x-api-key with Authorization: Bearer + add anthropic-beta header. Matches the exact headers cli.js sends for every OAuth request. ALIGNMENT.md compliance: change aligns OCP with cli.js; CI blacklist unaffected. Co-Authored-By: Claude Opus 4.6 --- server.mjs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/server.mjs b/server.mjs index f2983bf..53df99b 100644 --- a/server.mjs +++ b/server.mjs @@ -810,8 +810,9 @@ async function fetchUsageFromApi() { const doFetch = (bearerToken) => fetch("https://api.anthropic.com/v1/messages", { method: "POST", headers: { - "x-api-key": bearerToken, + "Authorization": `Bearer ${bearerToken}`, "anthropic-version": "2023-06-01", + "anthropic-beta": "oauth-2025-04-20", "Content-Type": "application/json", }, body,