use-native-credential-proxy

To inject Anthropic API keys from a .env file into a container environment, you enable the native credential path by setting NANOCLAW_NATIVE_CREDENTIALS=true. This reads credentials like ANTHROPIC_API_KEY and injects them as standard environment variables during container spawn.

Yes, you can use .env credentials to bypass the OneCLI vault by enabling the native credential path. This opt-out mechanism directly reads API keys and OAuth tokens from your .env file instead of relying on the OneCLI agent vault.

Native .env-based credential management reads ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, CLAUDE_CODE_OAUTH_TOKEN, and an optional ANTHROPIC_BASE_URL. These are parsed via core's readEnvFile and passed into the container environment.

Enabling native credentials provides an explicit opt-out of the OneCLI gateway, but the default OneCLI flow is preserved when the native credential path is disabled. You switch between them by toggling the NANOCLAW_NATIVE_CREDENTIALS setting.

To pass ANTHROPIC_BASE_URL when using .env credentials, include it in your .env file alongside your API keys. The skill wires a reach-in during container-spawn to pass these -e variables into the environment when the native path is activated.

Your .env OAuth tokens may not work with the OneCLI container agent because the native credential path is not activated. You must set NANOCLAW_NATIVE_CREDENTIALS=true in your .env file and restart NanoClaw to bypass the vault.