# Claude Plugin Authentication Methods: OAuth, API Keys, and Federated Access Explained

> Discover Claude plugin authentication methods including OAuth API keys and federated access. Securely integrate your plugins with Anthropic and third-party services.

- Repository: [Anthropic/claude-plugins-community](https://github.com/anthropics/claude-plugins-community)
- Tags: tutorial
- Published: 2026-09-10

---

**Claude plugins support five distinct authentication mechanisms—OAuth 2.0 browser flows, Anthropic API keys, Federation Rule IDs, Supabase JWT tokens, and auth-free static checks—enabling secure integration with both Anthropic’s APIs and third-party services.**

The `anthropics/claude-plugins-community` repository implements multiple authentication strategies depending on whether a plugin needs to maintain user sessions, call Anthropic’s native APIs, or perform deterministic static analysis. Each method is documented in the plugin configuration files and CLI READMEs, providing clear patterns for securing plugin-to-service communication.

## OAuth 2.0 Browser Authentication

The primary authentication method for user-facing plugins leverages **OAuth 2.0** with browser-based authorization. When a user runs the login command, the plugin opens a browser window redirecting to the service’s `/.well-known/oauth-authorization-server` endpoint.

Upon successful authorization, the plugin stores the **access token** and **refresh token** locally. In the QuickDesign CLI, these credentials are persisted to `~/.config/quickdesign/auth.json` according to the authentication documentation in [`quickdesign/README.md`](https://github.com/anthropics/claude-plugins-community/blob/main/quickdesign/README.md) (lines 106-114).

```bash

# Initiates the OAuth handshake and opens a browser window

quickdesign login

# Verify the stored credentials

quickdesign whoami

```

This workflow applies to plugins integrating with third-party SaaS platforms, including those referencing Amazon Location Service and other OAuth-enabled endpoints.

## Anthropic API Key Authentication

For direct API access, plugins accept a static **Anthropic API Key** via the `ANTHROPIC_API_KEY` environment variable. This method authorizes calls to the Claude API without requiring interactive browser authentication.

The GitHub Action `scan-plugins` documented in [`.github/actions/scan-plugins/README.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/scan-plugins/README.md) (lines 11-16) explicitly requires either this API key or a Federation Rule ID, reading the value from the environment or a local `.env` file.

```bash
export ANTHROPIC_API_KEY="sk-your-anthropic-api-key"

# Subsequent claude-code commands use this key automatically

```

## Federated Authentication with Rule IDs

Organizations using **Anthropic Federated Authentication** can supply a `ANTHROPIC_FEDERATION_RULE_ID` instead of a raw API key. This identifier instructs the backend which access policy to apply for the session, enabling centralized permission management without distributing long-lived secrets.

As noted in the same `scan-plugins` documentation, this method serves as a direct alternative to the standard API key for enterprise deployments.

```bash
export ANTHROPIC_FEDERATION_RULE_ID="your-federation-rule-id"

# Commands now authenticate using the federated rule

claude-code some-skill

```

## Supabase JWT Token Authentication

The QuickDesign plugin supports **short-lived Supabase JWT tokens** for specific sub-commands, particularly those interacting with design-related database operations. These tokens are either retrieved from the stored [`auth.json`](https://github.com/anthropics/claude-plugins-community/blob/main/auth.json) file or overridden via the `QUICKDESIGN_TOKEN` environment variable.

According to [`quickdesign/README.md`](https://github.com/anthropics/claude-plugins-community/blob/main/quickdesign/README.md) (lines 138-142), this token grants temporary access to Supabase-backed resources and can be injected directly into CI pipelines or local development environments.

```bash
export QUICKDESIGN_TOKEN="eyJhbGciOiJIUzI1NiIsInR5cCI6..."
quickdesign design list

```

## Auth-Free Static Checks

Certain continuous integration workflows operate without any authentication credentials. The `scan-plugins` GitHub Action includes an **auth-free mode** for deterministic pin checks, as documented in [`.github/actions/scan-plugins/README.md`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/scan-plugins/README.md) (lines 18-20).

This mode validates plugin metadata and static configuration files solely against public schemas, requiring no `ANTHROPIC_API_KEY`, OAuth tokens, or JWT secrets.

```bash

# Run static analysis without authentication

gh workflow run scan-plugins.yml

```

## Summary

- **OAuth 2.0** provides interactive browser authentication with tokens stored in `~/.config/quickdesign/auth.json`.
- **Anthropic API Keys** (`ANTHROPIC_API_KEY`) enable direct API authentication via environment variables.
- **Federation Rule IDs** (`ANTHROPIC_FEDERATION_RULE_ID`) support enterprise single sign-on without raw API keys.
- **Supabase JWT Tokens** (`QUICKDESIGN_TOKEN`) offer short-lived access for specific QuickDesign database operations.
- **Auth-free mode** allows CI systems to run static metadata checks without credentials.

## Frequently Asked Questions

### How do I store OAuth tokens securely for Claude plugins?

Claude plugins utilizing OAuth store tokens in platform-standard configuration directories. The QuickDesign CLI, for example, saves access and refresh tokens to `~/.config/quickdesign/auth.json` after a successful `quickdesign login` command. This file should be protected with appropriate filesystem permissions and excluded from version control.

### Can I use Claude plugins without an Anthropic API key?

Yes, certain operations support authentication-free execution. The `scan-plugins` GitHub Action can run static pin checks and metadata validation without any `ANTHROPIC_API_KEY` or OAuth tokens. However, any operation invoking the Claude API or accessing user-specific resources requires one of the documented authentication methods.

### What is the difference between ANTHROPIC_API_KEY and ANTHROPIC_FEDERATION_RULE_ID?

The `ANTHROPIC_API_KEY` is a static secret that directly authorizes API requests, while `ANTHROPIC_FEDERATION_RULE_ID` is an identifier used with Anthropic Federated Authentication that references a backend access policy. The rule ID allows organizations to enforce centralized permission controls without distributing raw API keys to individual users or CI systems.

### How long do Supabase JWT tokens last for QuickDesign authentication?

The `QUICKDESIGN_TOKEN` JWT tokens are short-lived credentials typically generated during the OAuth flow and stored alongside the main access token in [`auth.json`](https://github.com/anthropics/claude-plugins-community/blob/main/auth.json). While the exact expiration depends on the Supabase project configuration, these tokens are designed to be refreshed automatically or regenerated via the `quickdesign login` command when they expire.