ClaudeOauth
Bring Your Own Claude

Your Claude subscription. Anywhere.
Connect once. Call it from any app.

A self-hosted proxy that turns your Claude subscription into a simple, secret-protected HTTP API — with automatic token refresh, prompt caching, tool use, streaming and per-response cost accounting.

Open DashboardSee How It Works
  • Self-hosted on your Cloudflare account
  • Fails closed — no keyless access
  • Auto-refreshing OAuth token
claudeoauth.app/dashboard
Overview
Your ClaudeOauth Worker at a glance.
Connected
Claude Connection
Connected via OAuth
Worker operational Refresh token available Auto refresh enabled
06:42:18remaining
Requests
128
Tokens
84.2k
Cost
$1.42
heavy
Claude Opus 4.8
medium
Claude Sonnet 5
light
Claude Haiku 4.5
How it works

From Claude to your app in four steps.

No SDK lock-in, no extra backend. One Worker in your account, one secret, one HTTP endpoint.

01

Deploy

Deploy the Worker to your Cloudflare account.

02

Connect

Authorize Claude once via OAuth.

03

Call

Send requests through your private HTTP endpoint.

04

Track

Every response returns tokens and cost.

API

One Worker. A small API surface.

Eight routes, all behind one shared secret. Everything returns tokens and cost so you always know what a call did.

Health & Status

GET/health

Liveness and token status. Public, exposes no Claude access.

"auth_mode": "oauth_pkce"

OAuth Setup

GET/setup

Generate a PKCE authorization link, then post CODE#STATE back.

"auth_url": "https://claude.ai/oauth/…"

Token Import

POST/admin/tokens

Bring an existing access/refresh token set. The Worker refreshes from there.

"expires_at": 1755612000

Single Message

POST/api/messages

System + user prompt, tier selection, JSON mode, thinking budget.

"cost_usd": 0.0321

Conversation + Tools

POST/api/conversation

Multi-turn messages with tool definitions and tool_choice.

"stop_reason": "tool_use"

SDK Passthrough

POST/proxy/v1/messages

Raw Anthropic Messages API. Point any SDK at /proxy — SSE when stream:true.

ANTHROPIC_BASE_URL=…/proxy
Integrate

One curl away from your first response.

Every app that can make an HTTP request can use ClaudeOauth. Pass your secret as a Bearer token, pick a tier, get text and cost back.

  • Token refresh is not your problem

    The Worker holds the OAuth token in a Durable Object and rotates it ~1 hour before expiry — even with zero traffic.

  • Cost on every response

    Prompt, completion and cache tokens plus a USD figure come back with each call. No separate billing export.

  • Streaming through /proxy

    Point the Anthropic SDK at your Worker's /proxy path and keep streaming, tools and the rest of the Messages API.

terminal
curl -X POST \
  "https://claude-oauth.example.workers.dev/api/messages" \
  -H "Authorization: Bearer $SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "user_prompt": "Explain this code.",
    "model_tier": "medium"
  }'
Security

Your Worker. Your secret. Your infrastructure.

ClaudeOauth never sees your traffic. The dashboard talks to your Worker directly from the browser; the Worker talks to Claude.

Fail Closed

Every functional route requires your secret. If the secret is unset, the Worker returns 403 — there is no keyless path.

Self Hosted

Runs in your own Cloudflare account. The token lives in your Durable Object, not on a third-party server.

Optional IP Allowlist

Restrict requests at the Worker with ALLOWED_IPS. A leaked secret is useless from any other address.

OAuth Refresh

Tokens refresh automatically before expiry. Your apps only ever carry the shared secret.

Architecture

Two hops. One secret.

Apps hold only the shared secret. The Worker exchanges it for the OAuth Bearer it manages for you.

Browser / App
X-Internal-Secret
HTTPS
Your Worker
Durable Object · token
OAuth Bearer
Claude
Anthropic API

Point your apps at your Worker.

Unlock the dashboard with your Worker URL and secret. Credentials stay in this browser and go straight to your Worker.

Open DashboardRead the ClaudeOauth docs