Claude Code
Sign Claude Code in with your Claude subscription or an Anthropic API key, and what it uses in your terminals, in guests' shells and on your cloud boxes.
Claude Code signs in with your Claude subscription by default. An Anthropic API
key works too, if you would rather pay per call. Either way, taiku uses the
login claude already has; there is nothing to sign in to twice.
Sign in with your subscription
On your own computer:
claude auth loginIt opens the Claude sign-in page and saves the login. claude auth status shows
which account is signed in. A claude you start in a taiku terminal uses that
login, the same as in any other terminal.
Use an API key instead
Two ways, and they reach different places:
- Sign in with the key's account.
claude auth login --consolesigns in with your Anthropic Console account and bills calls to its API usage. This is a saved login, so it works everywhere a subscription login does, includingtaiku agent --local claudeand cloud boxes. On a Mac it is kept in the Keychain like the subscription login, so the Mac notes below apply to it too. - Export the key in your shell startup file. Put
export ANTHROPIC_API_KEY=...in~/.zshrcor~/.bashrc. taiku's shells run that file, so the key is there. A key you only exported in the terminal you started taiku from is not passed on. taiku keeps it out oftaiku agent --local, so an agent there never answers on an account you did not pick for it. It also stays out of a guest's sandboxed shell in the defaultisolatedmode, which does not run your startup files; atrustedsandboxed shell or one without the sandbox runs them, and gets the key.
Run it from taiku agent
taiku agent --local claudeThis runs claude on this machine with its own saved login, inside taiku's
sandbox. An exported ANTHROPIC_API_KEY is ignored here.
On a Mac, the subscription login lives in the Keychain, which the sandbox cannot
read, so taiku agent warns you before it starts and claude says it is not
logged in. Either run claude setup-token, then
export CLAUDE_CODE_OAUTH_TOKEN=<the token> before
taiku agent --local claude, or start it with --no-sandbox. The exported
token is used only when there is no ~/.claude/.credentials.json; delete a
stale one if claude still says it is not logged in.
Guests in your session
What a guest's shell gets from you depends on how it runs. Every sandboxed shell
the app opens for a guest on macOS or Linux runs in isolated mode.
| A guest's shell | Keys your startup files export | Your Claude login |
|---|---|---|
Sandboxed, isolated | No | No, whatever --agent-credentials says |
Sandboxed, trusted (not offered in the app) | Yes | With --agent-credentials own-or-host, for guests who have not signed in; with host, for everyone; with the default, own, no. On a Mac, see below |
| Without the sandbox: Ignore sandboxing, a session whose default is no sandbox, or a Windows host | Yes | The shell runs as you and can read it. --agent-credentials decides which login claude starts on: yours with own-or-host for guests who have not signed in, and with host for everyone |
On a Mac, Claude keeps its login in the Keychain, and no sandboxed shell can
read the Keychain, so a trusted shell gets your login only if it is saved in
~/.claude/.credentials.json instead. On Linux that file is where the login
lives.
With the default, own, a signed-in guest runs claude on their own login,
kept in a folder of theirs on your machine, and a guest who has not signed in
gets no agent. See
Guests use their own agent logins
and Guests on your machine.
On a cloud box
Two ways to have claude signed in on a box:
- From Settings. Press Sign in under
Settings → Agent → Claude Code on your cloud boxes.
taiku runs Claude Code's own sign-in on your cloud box and opens Claude's page
in the app; type the code it shows into the field under the row. Or paste a
token from
claude setup-tokenwith Add key. Every new shell you open on one of your Linux cloud boxes then starts signed in to your subscription, from any computer, a Mac included. The login stays with taiku and your shells borrow it. Once anyone else joins a session on a box, even just to watch, that box stops lending it for good. - Copied from your computer.
taiku cloudcopies your Claude login to a Linux box, along with your shell startup files (~/.zshrc,~/.bashrcand the like), when it opens a session there: the first time, and again whenever one of those startup files changes on your computer, the box's image changes or the box is rebuilt. Signing in again locally does not trigger a copy on its own; runtaiku cloud --refresh-agentsto copy the new login. That works from a Linux or Windows computer. On a Mac the login is in the Keychain and is not copied, so use Settings.taiku cloud --no-cloud-claude-authleaves the login behind for that run. An API key exported in your startup files reaches the box with them.
Boxes taiku runs for you come with claude installed. On a machine you bring
over SSH, install it yourself.
Hosted agents
The agents you keep on your account do not use your Claude subscription. They call the model with an API key: the one this taiku holds, or your own under Settings → Agent → Model providers.