Skip to content

Authentication

Claude Max Subscription (1-Year Token)

The executor uses a 1-year OAuth token from the Claude Max subscription. No API key billing.

Property Value
Token type sk-ant-oat01-... (OAuth)
Set via CLAUDE_CODE_OAUTH_TOKEN env var in LaunchAgent
Expires 2027-03-26
Bitwarden "Claude Code OAuth Token (1-Year, Mac Mini)"
Deadline Tracker #17 (warns 30 days before expiry)

How to Renew

  1. On a machine with a browser: claude setup-token
  2. Copy the sk-ant-oat01-... token
  3. Update the LaunchAgent plist: 
    # Edit ~/Library/LaunchAgents/ai.invotek.mac-executor.plist
# Update CLAUDE_CODE_OAUTH_TOKEN in EnvironmentVariables
  4. Restart executor: 
    launchctl bootout gui/$(id -u)/ai.invotek.mac-executor
launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/ai.invotek.mac-executor.plist
  5. Update Bitwarden entry
  6. Update deadline tracker

Important

  • ANTHROPIC_API_KEY is explicitly unset in the executor env to prevent API billing
  • The LaunchAgent must use /bin/bash (not /bin/zsh) — zsh breaks BASH_SOURCE

GitHub (iBuild-E Bot)

Property Value
GitHub App ibuild-e-bot
Auth method GitHub App installation token
Token refresh Automatic via get-token.py credential helper
Repos All managed repos (Stig-Johnny org)

The gh CLI uses a GitHub App installation token stored in ~/.config/gh/hosts.yml. The token auto-refreshes on each git operation via a credential helper.

Disabled Legacy Jobs

The following token sync jobs were disabled on 2026-03-26 when switching to the 1-year token:

Job File Status
Token sync com.invotek.ibuild-e.token-sync.plist.disabled Disabled
Monitor com.invotek.ibuild-e-monitor.plist.disabled Disabled
Consolidation com.invotek.ibuild-e-consolidation.plist.disabled Disabled
Auto-reauth ~/scripts/auto-reauth.sh.disabled Disabled
Token sync script ~/scripts/sync-token-to-openclaw.sh.disabled Disabled
Click auth ~/scripts/click-auth.py.disabled Disabled

Do not re-enable these

These jobs would overwrite the 1-year token with short-lived keychain tokens.