Anthropic has formally prohibited developers from using user credentials from its Free, Pro, and Max subscription plans to power third-party applications and services. The new policy, detailed in the legal documentation for its Claude Code platform, explicitly states that OAuth tokens obtained through these consumer accounts are intended exclusively for use with Claude Code and Claude.ai. Using these tokens in any other product, tool, or service—including Anthropic's own Agent SDK—is now a violation of the company's Consumer Terms of Service. This move effectively shuts down a potential loophole where developers could have built applications that routed requests through a user's personal subscription, bypassing the need for a direct commercial API agreement.

The distinction between authentication methods is central to the new rules. For individual users on consumer plans, access to Claude Code is managed via OAuth tokens linked to their Claude.ai accounts. In contrast, developers building products or services that interact with Claude's capabilities are directed to use official API key authentication through the Claude Console or a supported cloud provider like AWS Bedrock or Google Vertex AI. Anthropic is making a clear demarcation between individual, non-commercial use and commercial development, stating it does not permit third-party developers to offer Claude.ai login or to route requests through consumer plan credentials on behalf of their users.

This policy clarification arrives alongside details on how Claude Code integrates with existing commercial and compliance frameworks. For business customers using the Claude API directly or through cloud partners, their existing commercial agreements will govern Claude Code usage. The platform also extends specific compliance assurances; for healthcare customers with an active Business Associate Agreement (BAA) and Zero Data Retention enabled, the BAA will automatically cover their API traffic flowing through Claude Code. This provides a pathway for regulated industries to leverage the coding assistant while maintaining required data protections.

The update also reiterates that all Claude Code usage remains subject to the broader Anthropic Usage Policy. Furthermore, the advertised usage limits for the Pro and Max subscription tiers are defined with the assumption of "ordinary, individual usage" of both Claude Code and the Agent SDK, hinting at monitoring for atypical consumption patterns that might indicate credential sharing or automated abuse. By walling off the consumer authentication pathway, Anthropic is strengthening the business model for its official API and cloud partnerships, ensuring commercial usage is properly licensed and accounted for.

For the developer ecosystem, this creates a firmer, more predictable boundary. Tools and applications that wish to offer Claude's capabilities must now be built on a proper commercial foundation, using API keys billed directly to the developer or their organization. This prevents the scenario where a popular third-party app could inadvertently create massive, unpaid API costs for Anthropic by aggregating thousands of individual user tokens. It also protects consumer subscribers from having their personal account limits consumed by external services without their explicit knowledge or consent, aligning with broader platform security and trust principles.

The policy enforcement underscores a maturation phase for AI service providers, as they transition from open-ended exploration to establishing sustainable commercial infrastructures. Similar delineations between consumer and developer access have become industry standards. For Anthropic, clearly defining these lanes helps manage scale, control costs, and provide the appropriate level of support and compliance for different user types, from individual programmers to large enterprise teams building integrated AI solutions.