Claude Plugin Authentication Methods: OAuth, API Keys, and Federated Access Explained

Claude plugins support five distinct authentication mechanisms—OAuth 2.0 browser flows, Anthropic API keys, Federation Rule IDs, Supabase JWT tokens, and auth-free static checks—enabling secure integration with both Anthropic’s APIs and third-party services.

The anthropics/claude-plugins-community repository implements multiple authentication strategies depending on whether a plugin needs to maintain user sessions, call Anthropic’s native APIs, or perform deterministic static analysis. Each method is documented in the plugin configuration files and CLI READMEs, providing clear patterns for securing plugin-to-service communication.

OAuth 2.0 Browser Authentication

The primary authentication method for user-facing plugins leverages OAuth 2.0 with browser-based authorization. When a user runs the login command, the plugin opens a browser window redirecting to the service’s /.well-known/oauth-authorization-server endpoint.

Upon successful authorization, the plugin stores the access token and refresh token locally. In the QuickDesign CLI, these credentials are persisted to ~/.config/quickdesign/auth.json according to the authentication documentation in quickdesign/README.md (lines 106-114).

# Initiates the OAuth handshake and opens a browser window

quickdesign login

# Verify the stored credentials

quickdesign whoami

This workflow applies to plugins integrating with third-party SaaS platforms, including those referencing Amazon Location Service and other OAuth-enabled endpoints.

Anthropic API Key Authentication

For direct API access, plugins accept a static Anthropic API Key via the ANTHROPIC_API_KEY environment variable. This method authorizes calls to the Claude API without requiring interactive browser authentication.

The GitHub Action scan-plugins documented in .github/actions/scan-plugins/README.md (lines 11-16) explicitly requires either this API key or a Federation Rule ID, reading the value from the environment or a local .env file.

export ANTHROPIC_API_KEY="sk-your-anthropic-api-key"

# Subsequent claude-code commands use this key automatically

Federated Authentication with Rule IDs

Organizations using Anthropic Federated Authentication can supply a ANTHROPIC_FEDERATION_RULE_ID instead of a raw API key. This identifier instructs the backend which access policy to apply for the session, enabling centralized permission management without distributing long-lived secrets.

As noted in the same scan-plugins documentation, this method serves as a direct alternative to the standard API key for enterprise deployments.

export ANTHROPIC_FEDERATION_RULE_ID="your-federation-rule-id"

# Commands now authenticate using the federated rule

claude-code some-skill

Supabase JWT Token Authentication

The QuickDesign plugin supports short-lived Supabase JWT tokens for specific sub-commands, particularly those interacting with design-related database operations. These tokens are either retrieved from the stored auth.json file or overridden via the QUICKDESIGN_TOKEN environment variable.

According to quickdesign/README.md (lines 138-142), this token grants temporary access to Supabase-backed resources and can be injected directly into CI pipelines or local development environments.

export QUICKDESIGN_TOKEN="eyJhbGciOiJIUzI1NiIsInR5cCI6..."
quickdesign design list

Auth-Free Static Checks

Certain continuous integration workflows operate without any authentication credentials. The scan-plugins GitHub Action includes an auth-free mode for deterministic pin checks, as documented in .github/actions/scan-plugins/README.md (lines 18-20).

This mode validates plugin metadata and static configuration files solely against public schemas, requiring no ANTHROPIC_API_KEY, OAuth tokens, or JWT secrets.

# Run static analysis without authentication

gh workflow run scan-plugins.yml

Summary

• OAuth 2.0 provides interactive browser authentication with tokens stored in ~/.config/quickdesign/auth.json.
• Anthropic API Keys (ANTHROPIC_API_KEY) enable direct API authentication via environment variables.
• Federation Rule IDs (ANTHROPIC_FEDERATION_RULE_ID) support enterprise single sign-on without raw API keys.
• Supabase JWT Tokens (QUICKDESIGN_TOKEN) offer short-lived access for specific QuickDesign database operations.
• Auth-free mode allows CI systems to run static metadata checks without credentials.

Frequently Asked Questions

How do I store OAuth tokens securely for Claude plugins?

Claude plugins utilizing OAuth store tokens in platform-standard configuration directories. The QuickDesign CLI, for example, saves access and refresh tokens to ~/.config/quickdesign/auth.json after a successful quickdesign login command. This file should be protected with appropriate filesystem permissions and excluded from version control.

Can I use Claude plugins without an Anthropic API key?

Yes, certain operations support authentication-free execution. The scan-plugins GitHub Action can run static pin checks and metadata validation without any ANTHROPIC_API_KEY or OAuth tokens. However, any operation invoking the Claude API or accessing user-specific resources requires one of the documented authentication methods.

What is the difference between ANTHROPIC_API_KEY and ANTHROPIC_FEDERATION_RULE_ID?

The ANTHROPIC_API_KEY is a static secret that directly authorizes API requests, while ANTHROPIC_FEDERATION_RULE_ID is an identifier used with Anthropic Federated Authentication that references a backend access policy. The rule ID allows organizations to enforce centralized permission controls without distributing raw API keys to individual users or CI systems.

How long do Supabase JWT tokens last for QuickDesign authentication?

The QUICKDESIGN_TOKEN JWT tokens are short-lived credentials typically generated during the OAuth flow and stored alongside the main access token in auth.json. While the exact expiration depends on the Supabase project configuration, these tokens are designed to be refreshed automatically or regenerated via the quickdesign login command when they expire.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}