# Claude Code CLI — Auth, Flags, Gotchas

**2026-08-15** — Claude Code 2.1.197, authenticated via Anthropic API key

## Auth

Claude Code CLI 2.1 only accepts:
- `ANTHROPIC_API_KEY` env var (Anthropic's own key, not OpenRouter)
- `claude auth login` (interactive OAuth)

It does **not** support OpenRouter or third-party API keys natively. Do not pass OpenRouter keys — they will be rejected silently or with unclear errors.

## Install on read-only root

```
mkdir -p /root/.hermes/npm-global
HOME=/tmp/npm-home npm config set prefix /root/.hermes/npm-global
HOME=/tmp/npm-home npm install -g @anthropic-ai/claude-code
```

Then add to PATH:
```bash
export PATH="/root/.hermes/npm-global/bin:$PATH"
```

Or persist in Hermes config/scripts that call it.

## Non-interactive usage (Hermes delegation)

```bash
export ANTHROPIC_API_KEY="sk-ant-..."
claude -p "task prompt here" --output-format json
```

- `-p` / `--print`: non-interactive, returns result to stdout
- `--output-format json`: structured envelope (type, result, duration, usage, modelUsage)
- `--output-format text`: plain text output (good for quick smoke tests)
- `--json-schema <schema>`: enforce structured output from Claude (use with task contracts)
- `--allowed-tools`: restrict tool access (e.g., `WebSearch,Read,Write` — no Bash for safety)

## Structured output envelope

`--output-format json` returns:
```json
{
  "type": "result",
  "subtype": "success",
  "is_error": false,
  "result": "Claude's actual response text",
  "duration_ms": 16634,
  "usage": { "input_tokens": ..., "output_tokens": ... },
  "modelUsage": { "claude-haiku-4-5": {...}, "claude-opus-4-5": {...} }
}
```

Claude may wrap JSON inside the `result` string (as a code block). Parse carefully — extract the inner JSON if the task contract expects structured fields.

## Cost

Typical task: Haiku routes (~$0.0008) + Opus reasons (~$0.05). ~$0.05–$0.10 per reasoning task at current pricing. At 20 tasks/day = ~$30–$60/month.

## What Claude Code CLI is NOT

- It is headless — no Chrome Extension, no Connie desktop session
- It is not a replacement for Claude Desktop or the vault MCP bridge
- It does not share context with Hermes sessions automatically (each `claude -p` call is stateless)