🤖 feat: add Anthropic OAuth authentication for Claude Pro/Max subscription

[ibetitsmike]

Summary

Implements OAuth 2.0 + PKCE flow for authenticating with Claude Pro/Max accounts. This allows users to use their subscription for API calls instead of per-token billing (same as Claude Code CLI).

OAuth Flow

1. User triggers login → startOAuthFlow("max")
2. Opens https://claude.ai/oauth/authorize with PKCE challenge
3. User logs in and authorizes
4. User copies authorization code (format: code#state)
5. exchangeCodeForTokens(code, verifier) → access + refresh tokens
6. API calls use Bearer token instead of x-api-key
7. Automatic token refresh when expired

Key Implementation Details

Component	Description
Client ID	9d1c250a-e61b-44d9-88ed-5944d1962f5e (same as Claude Code)
Auth URL	https://claude.ai/oauth/authorize
Token URL	https://console.anthropic.com/v1/oauth/token
Scopes	org:create_api_key user:profile user:inference
Storage	~/.mux/oauth.json

Authentication Priority

When using Anthropic models, authentication is checked in this order:

1. OAuth credentials (from ~/.mux/oauth.json) - uses subscription
2. providers.jsonc config (apiKey)
3. ANTHROPIC_API_KEY environment variable
4. ANTHROPIC_AUTH_TOKEN environment variable

API

// Start OAuth flow
const { authUrl, verifier } = await api.oauth.anthropic.start("max");
// Open authUrl in browser, user copies code

// Exchange code for tokens
await api.oauth.anthropic.exchange(code, verifier);

// Check status
const { authenticated, expiresAt } = await api.oauth.anthropic.status();

// Logout
await api.oauth.anthropic.logout();

Note

This PR adds the backend infrastructure. A follow-up PR will add the UI for login/logout in the Settings panel.

Generated with mux

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".