[BUG] VS Code extension ignores apiKeyHelper from settings.json — falls back to Console OAuth

[dimidir]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

apiKeyHelper in ~/.claude/settings.json is not picked up by the VS Code extension. The CLI reads it and authenticates correctly. The extension behaves as if the setting doesn't exist — it shows the Console OAuth login prompt on first launch.
If the user completes the OAuth flow and has the Developer role in the Anthropic API org, the Console silently auto-generates a new API key. The user never asked for this key, and it's not the one the admin provisioned.

What Should Happen?

The extension should use the apiKeyHelper command from ~/.claude/settings.json to authenticate — same as the CLI does. No OAuth prompt, no auto-generated keys.

The https://code.claude.com/docs/en/settings list apiKeyHelper as a standard setting. The https://code.claude.com/docs/en/vs-code state that ~/.claude/settings.json is "shared between the extension and CLI." No carve-out is documented.

Error Messages/Logs

No error. The extension silently ignores apiKeyHelper and shows the login screen as if the setting doesn't exist.

Steps to Reproduce

1. Configure apiKeyHelper in ~/.claude/settings.json with a command that returns a valid API key (e.g., op item get 'dev-delivery-{name}' --fields password --reveal --vault 'Anthropic - {Name}')
2. Run claude in terminal — CLI authenticates using the helper, responds to prompts
3. Open the VS Code extension on the same machine
4. Extension shows the "Sign in" screen instead of using the helper key
5. If you complete Console OAuth and the user has Developer role in the API org, a new key is auto-generated instead of using the admin-provisioned one

Claude Model

Not sure / Multiple models

Is this a regression?

No, this never worked

Last Working Version

No response

Claude Code Version

2.1.81 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

VS Code integrated terminal

Additional Information

• Related: [BUG] Claude Desktop doesn't work with apiKeyHelper #26745 (same symptom on Claude Desktop / Windows / v2.1.47, auto-closed for inactivity), [BUG] VS Code extension 2.0.5.0: Invalid API key · Please run /login and black screen even after successful Anthropic Console OAuth and manual API key setup #12204 (root extension auth bug, still open 7 months)
• ANTHROPIC_API_KEY env var is NOT set. No conflicting auth state.
• Tested with a team member's machine, not just admin. Same result.
• Completing Console OAuth when user has Developer role creates an unmanaged key that breaks per-developer cost attribution. The only current mitigation is "don't use the extension."

[github-actions]

Found 3 possible duplicate issues:

1. [BUG] Freshly installed Claude Code ignores settings.json #13827
2. VSCode extension ignores per-workspace auth when using CLAUDE_CONFIG_DIR #34888
3. [BUG]: Claude Code VSCodium extension: login fails despite API key present in config.json #37959

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[github-actions]

This issue has been automatically closed as a duplicate of #13827.

If this is incorrect, please re-open this issue or create a new one.

🤖 Generated with Claude Code

[dimidir]

These are not duplicates:

#13827 is CLI (not extension) ignoring settings.json env vars on fresh install — a regression in v2.0.65 that affects the CLI only, and only on first run before ~/.claude.json exists. apiKeyHelper is not involved.

#34888 is about CLAUDE_CONFIG_DIR workspace isolation, not apiKeyHelper — and is already marked duplicate itself.

#37959 is VSCodium-specific OAuth callback failure on Windows — different platform and root cause.

---

This issue is specifically about apiKeyHelper being silently ignored by the VS Code extension on every run, while the CLI on the same machine reads it correctly.

Confirmed today through direct side-by-side testing (VS Code + Cursor, CLI vs extension):

• CLI in VS Code integrated terminal: reads apiKeyHelper correctly, authenticates with the admin-provisioned key, usage attributed to the correct named key in Console
• VS Code extension panel: ignores apiKeyHelper, triggers Console OAuth every time
• Cursor extension panel (same Claude Code extension, installed from Cursor marketplace): same behavior — ignores apiKeyHelper, triggers Console OAuth
• This is not a fresh-install issue — it happens on every session regardless of machine state

Why this matters more than a workaround suggests:

The extension has meaningfully better UX than the CLI for many workflows: plan mode renders as a structured full panel (not inline terminal), diffs show side-by-side with proper context, editor selection is passed correctly, the conversation layout is more readable. These are real reasons developers reach for the extension over the CLI.

The governance problem forces teams to block extension use entirely and mandate CLI-only — not because the CLI is better, but because the extension breaks key attribution. Fixing apiKeyHelper support in the extension would let teams use the better UX without sacrificing governance.

The governance impact (Console OAuth auto-generating unmanaged keys for Developer-role users, or silently billing to a Claude Team subscription with zero per-user attribution) is not mentioned in any of the three flagged duplicates. This is a distinct issue affecting teams with managed API key infrastructure.

[github-actions]

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.