Claude Code Gateway Models Missing? Fix apiKeyHelper Discovery

If Claude Code can send prompts through your LLM gateway but /model has no "From gateway" entries, check the credential source before changing the gateway. Current reports show gateway discovery can skip /v1/models when authentication comes only from apiKeyHelper, even though the same helper works for inference. Confirm that exact split, then use a child-process ANTHROPIC_AUTH_TOKEN test or one explicit custom model while the upstream bug remains open.

This guide is for the narrow case where all of these are true:

• ANTHROPIC_BASE_URL points to an Anthropic Messages-compatible gateway;

• CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1 is set;

• apiKeyHelper supplies a valid short-lived credential;

• normal Claude Code prompts succeed; and

• /model does not show models returned by the gateway.

Do not use this diagnosis when inference also fails. That is an authentication or gateway-compatibility problem, not a discovery-only failure.

Confirm the Documented Gates

Anthropic documents gateway model discovery for Claude Code 2.1.129 or later. It runs only for a non-Anthropic ANTHROPIC_BASE_URL that exposes the Anthropic Messages format. The returned model IDs must begin with claude or anthropic.

Check only the non-secret inputs:

claude --version
printf 'base URL: %s\n' "$ANTHROPIC_BASE_URL"
printf 'discovery: %s\n' "$CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY"
printf 'nonessential traffic disabled: %s\n' "$CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC"

Expected results:

• Claude Code is 2.1.129 or newer;

• the base URL is your gateway, not api.anthropic.com;

• discovery prints 1; and

• nonessential traffic is empty while you test discovery.

Do not print the helper output, an auth token, a settings file, or request headers into a shared terminal or issue report.

Reproduce the Silent Discovery Failure

Start one ordinary session with debug logging:

claude --debug

Inside Claude Code, run:

/status
/model

Exit, then inspect only the presence of the cache and discovery markers:

test -f ~/.claude/cache/gateway-models.json \
  && echo 'gateway cache present' \
  || echo 'gateway cache absent'

rg -n 'gatewayDiscovery|models\?limit|/v1/models' ~/.claude/debug/latest

Ask the gateway operator whether that launch produced GET /v1/models. Do not request or paste the authorization header.

The reported apiKeyHelper failure has a distinctive four-part signature:

If a request reached /v1/models and failed, inspect its HTTP status and response schema instead. If the request succeeded but models are missing, verify that their IDs start with claude or anthropic.

A/B Test the Credential Source Safely

The strongest public reproductions changed only the credential source. They used the same helper output as a child-scoped bearer token, then observed the discovery request, cache, and model rows.

On a trusted machine, replace the placeholder with the absolute path already configured as apiKeyHelper:

set +x
ANTHROPIC_AUTH_TOKEN="$(/absolute/path/to/get-token.sh)" claude --debug

This token exists only in the launched process environment. Do not use export, paste the token, enable shell tracing, or save it in a shell profile.

Run /model, exit, and repeat the cache and debug checks. Interpret the result narrowly:

• If discovery now works, the credential source is the isolated variable. Keep the evidence and track the upstream reports.

• If discovery still does not run, restore the ordinary launch path and check the documented gates again.

• If inference fails in either run, stop. The experiment no longer isolates model discovery.

This is a diagnostic and short-lived workaround, not proof of Anthropic's internal root cause. The issue authors suspect discovery checks for a credential before asynchronous helper resolution finishes, but Anthropic has not confirmed that explanation.

Use One Explicit Model Without Changing Authentication

If you only need one gateway model, Anthropic documents an explicit picker entry. Ask the gateway operator for the exact non-secret model ID and set it for a fresh session:

export ANTHROPIC_CUSTOM_MODEL_OPTION="claude-your-approved-model"
export ANTHROPIC_CUSTOM_MODEL_OPTION_NAME="Approved gateway model"
claude

Claude Code skips its normal model-ID validation for this option, so use only an ID approved by the gateway owner. This adds one picker entry; it does not repair dynamic discovery or enumerate the gateway's catalog.

Remove the temporary variables when the upstream discovery path works with apiKeyHelper:

unset ANTHROPIC_CUSTOM_MODEL_OPTION
unset ANTHROPIC_CUSTOM_MODEL_OPTION_NAME

For the broader decision between secret-bearing local configuration and delegated access, see API keys vs OAuth for agent integrations. If the gateway problem is actually an MCP connection failure, use the separate Claude Code MCP connection diagnostic.

What Not to Do

• Do not delete all of ~/.claude to force discovery.

• Do not copy a short-lived token into project settings or a committed file.

• Do not expose a helper's stdout, gateway headers, or access tokens in an issue.

• Do not assume successful inference proves /v1/models was requested.

• Do not hardcode a model ID that the gateway owner has not approved.

• Do not describe the suspected startup-order explanation as an upstream-confirmed root cause.

Reusable Diagnostic Prompt

Give Claude Code this bounded request:

Diagnose missing gateway models without changing authentication or files. Report the Claude Code version, whether the non-secret gateway discovery gates are set, whether normal inference succeeds, whether /model has "From gateway" entries, whether the gateway cache exists, and whether the latest debug log contains discovery markers. Do not print credentials, execute apiKeyHelper, edit settings, delete caches, export tokens, or contact the gateway.

Success is measurable: you can say whether the problem is a discovery-only failure, whether /v1/models ran, and whether changing only the credential source changes the result.

To monitor the upstream reports without giving an agent a GitHub token, start with Aident Loadout:

Follow https://aident.ai/SETUP.md

Then ask:

Check Aident Loadout authentication and Vault status. Discover the current read-only GitHub issue Action, inspect its schema, and preflight lookups for anthropics/claude-code issues 84683, 83515, and 56675. If the lookups are valid and free, execute them and return only state, updated time, labels, title, and canonical URL. Do not comment, react, edit, close, or create anything.

Set up Aident Loadout and monitor gateway discovery.

Sources

• Claude Code LLM gateway configuration and model discovery

• Claude Code authentication precedence and apiKeyHelper

• Claude Code custom model picker option

• Current apiKeyHelper discovery report on Claude Code 2.1.223, issue 84683

• Independent reproduction on Claude Code 2.1.220, issue 83515

• Original Linux reproduction on Claude Code 2.1.129 and 2.1.131, issue 56675

• Duplicate reproduction on Claude Code 2.1.140, issue 58581

• Nonessential-traffic discovery edge case, issue 61112

Refresh this guide when issue 84683 changes state, Anthropic documents helper-backed discovery behavior, or a Claude Code release makes the child-scoped credential test unnecessary.