[BUG] Claude Code silently billed $447 to API instead of Max subscription, then gave incorrect auth confirmation

[drdonnelly]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

Claude Code version: Latest (as of May 25, 2026)
OS: macOS (Darwin 25.3.0)

What happened

During Claude Code CLI sessions on May 24-25, 2026, my authentication silently
defaulted to API billing instead of my active Max subscription. I was charged $447.30
in API credits that should have been covered by Max.

The critical issue

When I explicitly asked Claude Code to verify my billing mode during the session, it
incorrectly confirmed I was on my Max subscription — twice. I relied on this and
continued working. The Usage dashboard at console.anthropic.com also showed $0 at the
time due to a reporting lag, further masking the problem.

The issue was only discovered after the session. Running claude auth login followed by
claude auth status then correctly showed subscriptionType: "max".

Three compounding failures

1. Auth defaulted to API billing without any warning, despite having an active Max
   subscription
2. Claude Code gave incorrect billing confirmation when directly asked — twice
3. Usage dashboard showed $0 due to reporting lag, hiding the charges

Expected behavior

• Claude Code should use Max subscription when one is active
• If falling back to API billing, it should warn the user explicitly
• claude auth status (or equivalent checks during a session) should return accurate
  billing information

Support response

I contacted support@anthropic.com requesting a refund. The AI support agent denied it,
stating "API credits that have been consumed are non-refundable under our Credit
Terms... regardless of the underlying cause — including authentication issues or
product bugs." It also stated it cannot escalate to a human reviewer.

A policy that charges users $447 due to a product bug, gives them incorrect
information when they try to verify, and then refuses a refund with no human
escalation path is not acceptable.

What Should Happen?

• Claude Code should use Max subscription when one is active
  • If falling back to API billing, it should warn the user explicitly
  • claude auth status (or equivalent checks during a session) should return accurate
    billing information

Error Messages/Logs

Steps to Reproduce

Error: Exit code 127

Claude Model

Sonnet (default)

Is this a regression?

Yes, this worked in a previous version

Last Working Version

No response

Claude Code Version

Claude Code version: Latest (as of May 25, 2026) OS: macOS (Darwin 25.3.0)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Support response

I contacted support@anthropic.com requesting a refund. The AI support agent denied it,
stating "API credits that have been consumed are non-refundable under our Credit
Terms... regardless of the underlying cause — including authentication issues or
product bugs." It also stated it cannot escalate to a human reviewer.

A policy that charges users $447 due to a product bug, gives them incorrect
information when they try to verify, and then refuses a refund with no human
escalation path is not acceptable.

[github-actions]

Found 3 possible duplicate issues:

1. Claude Code bills API instead of Max subscription — OAuth response missing organizationType for specific org #58625
2. claude -p headless sessions billing misrepresented by model — repeated false confirmations led to €80+ unexpected charges #61704
3. [BUG] Claude Code silently uses project ANTHROPIC_API_KEY from .env instead of Max plan OAuth, causing unexpected API charges #58083

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[drdonnelly]

This is not a duplicate. The linked issues may report similar auth bugs, but my issue
specifically documents:

1. $447.30 in charges caused by this bug — a concrete financial impact
2. Claude Code gave incorrect auth confirmation twice when directly asked — this is a
   separate, compounding failure
3. Anthropic support refused a refund via AI agent with no human escalation path

The auth bug may be known, but the billing impact and support response need to be
addressed. This issue should remain open until a refund is processed.

[drdonnelly]

This is not a duplicate — it's the same unresolved bug still costing users money.

The linked issues prove this is a known, recurring pattern:

• Claude Code bills API instead of Max subscription — OAuth response missing organizationType for specific org #58625: OAuth refresh returns null subscription metadata, silently falling back to
  API billing — reported May 13, still open
• claude -p headless sessions billing misrepresented by model — repeated false confirmations led to €80+ unexpected charges #61704: Claude confidently gave incorrect billing assurances (same as my experience)
  — €84.68 charged, still open
• [BUG] Claude Code silently uses project ANTHROPIC_API_KEY from .env instead of Max plan OAuth, causing unexpected API charges #58083: API key silently prioritized over Max subscription — $52 charged, still open

None of these have been resolved or refunded. Combined with my $447.30, that's over
$600 in documented charges from the same class of bug across at least 4 users. The
auto-close bot flagging these as "duplicates" is actually evidence that Anthropic is
aware of this problem but hasn't fixed it or made the affected users whole.

I'm requesting this issue remain open until: (1) the auth bug is fixed, and (2)
affected users are refunded.

[prasadt3]

I had exactly the same problem. I got charged close to $1600 from May 23rd to May 25th.

[prasadt3]

@drdonnelly I figured out what is going on.

At some point in the last couple of days, claude code overrode my max plan and kept defaulting to APIs. I did everything from uninstall to reinstall and it did not work. When I installed it on a fresh machine, it recognized my max plan.

After some research, I found an anthropic directory in ~/.config/anthropic which contains a credentials file. It has workspace name and some credentials in it.

I backed up that folder and deleted it. And launched Claude Code and it automatically asked me to login and this time it shows Claude Max as the subscription in the welcome screen as well as usage stats.

[yurukusa]

@prasadt3's root-cause find is the cleanest articulation I've seen of this failure mode so far. The stale credentials file in ~/.config/anthropic/ taking precedence over the active Max subscription session — and the auth confirmation routing through the same stale credentials, hence the "confirmed Max" lie — explains both the silent billing divergence and the incorrect verification response in one mechanism.

A few cross-references that may help bracket this:

This is the same cluster as #58625, #61704, #58083 — but the surface is broader

This failure mode now spans at least 4 surfaces in the May 2026 issue corpus:

• OAuth refresh returns null subscription metadata (Claude Code bills API instead of Max subscription — OAuth response missing organizationType for specific org #58625)
• Confident incorrect billing assurance (claude -p headless sessions billing misrepresented by model — repeated false confirmations led to €80+ unexpected charges #61704, drdonnelly's compounding failure here)
• API key silently prioritized over Max ([BUG] Claude Code silently uses project ANTHROPIC_API_KEY from .env instead of Max plan OAuth, causing unexpected API charges #58083)
• Stale credentials file shadowing active subscription (prasadt3's find in this thread)

The architectural shape they share: the agent surface and the billing surface read from different state sources, and when they disagree, the agent surface always wins for the user-facing report. No verification path exists for the operator to cross-check "what billing context will this session actually charge against" before tokens are spent.

This is also one of the four open clusters I've been tracking publicly at https://yurukusa.github.io/cc-safe-setup/cluster-tracker.html — the "multi-account" cluster (#18435 / #27302 / #36151, combined 1,178 reactions). Different surface manifestations, same architectural gap.

Operator-side hardening that catches this before the bill arrives

While the upstream fix is pending, two MIT defense hooks shipped to cc-safe-setup last week target this specific divergence:

• account-routing-preflight.sh (PR #328, SessionStart hook). Refuses session start when the active credentials file's account doesn't match the expected account for the working directory. Catches the prasadt3-style stale credentials shadow before the session even begins.
• account-billing-log.sh (same PR, Stop hook). Logs per-session billing reconciliation events (what account, what tokens, expected vs. actual) so the divergence is surfaced in seconds rather than at the end-of-month bill.

Install (from main branch, npm publish pending):

curl -s https://raw.githubusercontent.com/yurukusa/cc-safe-setup/main/examples/account-routing-preflight.sh \
  -o ~/.claude/hooks/account-routing-preflight.sh && chmod +x ~/.claude/hooks/account-routing-preflight.sh
curl -s https://raw.githubusercontent.com/yurukusa/cc-safe-setup/main/examples/account-billing-log.sh \
  -o ~/.claude/hooks/account-billing-log.sh && chmod +x ~/.claude/hooks/account-billing-log.sh

MIT, no telemetry, single-file install. The hooks log to ~/.claude/billing-log/ so you have a per-session audit trail to attach to any refund request.

Suggested triage discipline for anyone hitting this

1. Immediately run cat ~/.config/anthropic/credentials.json (or wherever your platform stores it) and check the workspace_id / account_id field. If it doesn't match what you expect, back it up and delete (prasadt3's fix). Re-auth.
2. Before resuming work, run a tiny session and check console.anthropic.com usage in real time (the lag the original report mentions is real — but it's bounded; if usage is non-zero on a Max-eligible session within ~5 minutes, you're being charged API).
3. For refunds, the per-session billing log is the strongest evidence. Anthropic's AI agent triage tends to bounce auth-vs-billing claims for lack of session correlation; a timestamped log per session sidesteps that.

Happy to add prasadt3's specific reproduction (stale ~/.config/anthropic/ file) to the account-routing-preflight hook's symptom catalogue if useful — the current version covers OAuth-refresh-null but doesn't explicitly check for credentials-file staleness as a distinct trigger.

[skeegan]

Same pattern here. Was charged ~€180 to API via Claude Code in early May despite an active Max subscription. Session logs showed sub usage, invoice told a different story. Support was an AI loop - "API credits are non-refundable" regardless of cause.

I've started working on this to help with the issue: cost.botzone.ai (https://github.com/botzone-ai).

[shakeapp1]

Same thing here — adding cross-platform confirmation plus a root cause and the only fix that worked for me.

I'm also a Max subscriber, on Windows (your report is macOS — so this isn't OS-specific). The charges drained the Extra Usage on my Max subscription. My developer Console account is at $0.00 and has never been used — so this is subscription-side Extra Usage being silently consumed, not developer-API usage.

I hit the same "the tool reassures you while it keeps billing you" failure: /login → subscription flipped my banner to Claude Max, but Extra Usage kept draining anyway. The only thing that actually stopped it was uninstalling the standalone Claude Code CLI. I have both Claude Desktop and the CLI installed — the dual install is the trigger: despite the active subscription, the CLI silently runs in a metered "API Usage Billing" mode that charges Extra Usage instead of drawing on the plan's included allowance. (To be clear: "API Usage Billing" is just the CLI's label for metered rates — the money still comes out of the subscription's Extra Usage, not a separate developer-API balance.)

I also got the identical refund denial — "consumed credits are non-refundable… regardless of the underlying cause, including bugs" — and the AI agent first said it couldn't escalate. (I did eventually reach a human reviewer by pushing back, so it is possible.)

I've documented this in detail — /status output, the dual-install behavior, and the fix — here: #68501

This really needs an official response. Subscribers are being silently billed real money for usage that should be covered by their plan, then told it's non-refundable.