Skip to content

fix: fall back to macOS Keychain when credentials.json is missing #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hamiltoon wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: fall back to macOS Keychain when credentials.json is missing #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ Claude Code → JSON stdin → statusline.sh → formatted status string

Every 60 seconds (configurable), the script calls the Anthropic usage API with your OAuth token. The call takes ~200ms and runs inline — no background processes, no tmux, no scraping.

The OAuth token is read from `~/.claude/.credentials.json`, which Claude Code maintains automatically during active sessions. If the token is expired or the API is unreachable, the script silently falls back to cached data or displays without usage info.
The OAuth token is read from `~/.claude/.credentials.json`, which Claude Code maintains automatically during active sessions. On macOS, where Claude Code stores credentials in the system Keychain instead of a file, the script falls back to `security find-generic-password -s "Claude Code-credentials" -w`. If the token is expired or the API is unreachable, the script silently falls back to cached data or displays without usage info.

### About the Usage API

Expand Down Expand Up @@ -121,7 +121,7 @@ You may have been rate-limited by the Anthropic API (e.g. `REFRESH_INTERVAL` was
> **Multiple Claude Code windows?** All windows share the same cache file (`~/.claude/usage-exact.json`). Whichever window renders first past the 60s mark will call the API and refresh the cache for all others. You won't get multiple simultaneous API calls from the same machine.

**Usage bars missing?**
Check that `~/.claude/.credentials.json` exists and contains a valid `claudeAiOauth.accessToken`. This file is created automatically when you log into Claude Code.
Check that `~/.claude/.credentials.json` exists and contains a valid `claudeAiOauth.accessToken`. This file is created automatically when you log into Claude Code. On macOS, credentials live in the Keychain instead — verify with `security find-generic-password -s "Claude Code-credentials" -w | jq .claudeAiOauth.accessToken`.

**Force a refresh:**
```bash
Expand Down
11 changes: 8 additions & 3 deletions statusline.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,9 +147,14 @@ fi

# ── Refresh usage via Anthropic OAuth API ────────────────────────────────────
refresh_usage_api() {
[ ! -f "$CREDENTIALS_FILE" ] && return 1
local token
token=$(jq -r '.claudeAiOauth.accessToken // empty' "$CREDENTIALS_FILE" 2>/dev/null)
local token creds
if [ -f "$CREDENTIALS_FILE" ]; then
token=$(jq -r '.claudeAiOauth.accessToken // empty' "$CREDENTIALS_FILE" 2>/dev/null)
fi
if [ -z "$token" ] && command -v security >/dev/null 2>&1; then
creds=$(security find-generic-password -s "Claude Code-credentials" -w 2>/dev/null)
[ -n "$creds" ] && token=$(printf '%s' "$creds" | jq -r '.claudeAiOauth.accessToken // empty' 2>/dev/null)
fi
[ -z "$token" ] && return 1
local resp
resp=$(curl -s --max-time 3 \
Expand Down