Support using Claude Code's existing login session (Team/Pro plan) instead of requiring a separate Anthropic API key

[coderjingtao]

Problem Statement

Currently, ocr requires a standalone LLM credential to be configured via ocr config set llm.auth_token ... (or OCR_LLM_TOKEN). This works for users who have a pay-as-you-go Anthropic API key, but it doesn't work for users like myself who access Claude only through a Claude Code Team/Pro plan subscription.
Claude Code itself authenticates via an OAuth/session login (not a raw API key), and that login is tied to the subscription's included usage rather than metered API billing. Since open-code-review supports being invoked as a Claude Code plugin/skill (/open-code-review), I expected it could reuse Claude Code's existing authenticated session to make model calls — but based on the docs, the ocr CLI still makes its own independent request using llm.auth_token, completely separate from Claude Code's login state. This means Team/Pro plan users can't use this tool without also purchasing separate API credits.

Proposed Solution

When open-code-review is run inside a Claude Code session (e.g. via the plugin/slash-command integration), allow it to delegate the actual review generation to Claude Code's own agent/model-call mechanism instead of requiring ocr to independently authenticate to api.anthropic.com with its own key. For example:

A mode where the Skill/Plugin instructs Claude Code itself to perform the diff analysis and produce review comments (using Claude Code's own tool-use loop), rather than ocr shelling out to a separately-configured LLM endpoint.
Or, at minimum, documentation clarifying whether/how Team or Pro plan users (without a separate API key) can use this tool.

Alternatives Considered

Purchasing a separate Anthropic API key just for this tool — works, but means paying twice for the same underlying model access.
Writing my own custom Claude Code Skill that performs the review logic natively so it runs entirely on the Team plan's included usage — functional, but duplicates work that open-code-review already does well.

Affected Area

Review Agent / LLM interaction

Additional Context

It would be great if the README could explicitly state which integration modes (if any) work purely on a Claude Code subscription login vs. which strictly require a standalone API key with llm.auth_token. Right now this isn't obvious from the docs and could be a source of confusion for other Team/Pro plan users.

[lizhengfeng101]

Hi @coderjingtao, thanks for the thoughtful writeup — this is a real gap and you've articulated it well.

Why we won't reuse Claude Code's subscription login for direct API calls

We looked into having ocr reuse the Claude Code subscription (OAuth) session directly, but it isn't viable — for both technical and policy reasons:

• A Claude Code subscription login is an OAuth token, not an API key, and Anthropic's servers deliberately restrict it. Such tokens only work with a specific beta header and Claude Code's own request shape (e.g. the official system-prompt prefix); a generic POST /v1/messages from a third-party tool is rejected.
• Extracting that token and replaying it from another tool would violate Anthropic's Terms of Service and put users' accounts at risk of suspension.

So while it's technically tempting, we're not going to ship anything that shuttles the subscription token out to ocr's own LLM endpoint — we don't want to expose our users to that risk.

What we're doing instead

As the project has gotten more visibility recently, we've seen this exact request come up more and more — you're far from alone. So we're now designing the approach you proposed as your first option: a delegate mode.

In this mode ocr no longer depends on a separately-configured LLM endpoint. Instead it does what it's best at — resolving the review scope, applying excludes, loading review rules, injecting your background context, and collecting the diffs — and hands that off as a structured review task for Claude Code to execute using its own agent loop and included subscription usage. No standalone API key required.

We'll also clarify the README in the meantime so it's explicit which modes need a standalone API key vs. which will run purely on a Claude Code subscription.

We're prioritizing this and aim to ship it soon. Thanks again for pushing on it — I'll update this issue as the delegate mode lands.