fujin/anthropic-proxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixes, readme

Browse Source
This commit is contained in:
Alexander
2026-04-09 23:06:17 +02:00
parent 909c8b1894
commit f22765d8f0
5 changed files with 170 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+58
View File
@@ -0,0 +1,58 @@
# anthropic-proxy
Reverse proxy that lets OpenCode (and similar tools) use a Claude subscription instead of an API key.
## Prerequisites
- Go 1.26+
- **Claude Code CLI** — installed and logged in (`claude auth login`). The proxy reads the OAuth token from `~/.claude/.credentials.json`.
Optional: [Nix](https://nixos.org/) flake for dev shell (`nix develop`).
## Setup
```
cp config.example.yaml config.yaml
```
Edit `config.yaml`:
- `api_keys` — key(s) your clients use to authenticate with the proxy
- `claude_credentials` — path to your Claude credentials file
- `auth_dir` — optional, directory with additional OAuth credential JSON files
- `claude_binary` — path to `claude` binary (used on startup to capture request fingerprint)
## Build and run
```
go build -o anthropic-proxy .
./anthropic-proxy
```
## Usage with OpenCode
```
export ANTHROPIC_API_KEY=your-proxy-api-key
export ANTHROPIC_BASE_URL=http://localhost:8082
opencode
```
## Endpoints
| Method | Path | Description |
|--------|------|-------------|
| POST | `/v1/messages` | Anthropic messages API (proxied) |
| POST | `/messages` | Same, without `/v1` prefix |
| GET | `/healthz` | Health check |
| POST | `/reload` | Hot-reload `config.yaml` |
## Request sanitization
The `sanitize` section in config renames tool names and replaces strings in system prompts before forwarding to Anthropic. Responses are de-sanitized before returning to the client.
See `config.example.yaml` for the default rules.
Reload after editing config:
```
curl -X POST localhost:8082/reload
```
internal/auth/refresh.go
+8 -3
View File
@@ -215,11 +215,16 @@ func (t *utlsRefreshTransport) RoundTrip(req *http.Request) (*http.Response, err
}
// StartBackgroundRefresh runs a goroutine that checks and refreshes tokens periodically.
func StartBackgroundRefresh(pool *Pool) {
func StartBackgroundRefresh(ctx context.Context, pool *Pool) {
go func() {
for {
time.Sleep(refreshInterval)
refreshAll(pool)
select {
case <-ctx.Done():
log.Printf("background refresh stopped")
return
case <-time.After(refreshInterval):
refreshAll(pool)
}
}
}()
}
internal/proxy/handler.go
+2 -3
View File
@@ -10,12 +10,10 @@ import (
"github.com/tidwall/gjson"
"github.com/fujin/anthropic-proxy/internal/auth"
"github.com/fujin/anthropic-proxy/internal/config"
)
func HandleMessages(pool *auth.Pool, profile *SniffedProfile, sanitizeCfg config.SanitizeConfig) gin.HandlerFunc {
func HandleMessages(pool *auth.Pool, profile *SniffedProfile, getSanitizer func() *Sanitizer) gin.HandlerFunc {
upstream := NewUpstreamClient(profile)
san := NewSanitizer(sanitizeCfg)
return func(c *gin.Context) {
body, err := io.ReadAll(c.Request.Body)
@@ -26,6 +24,7 @@ func HandleMessages(pool *auth.Pool, profile *SniffedProfile, sanitizeCfg config
log.Printf("incoming: %s %s (%d bytes) model=%s", c.Request.Method, c.Request.URL.Path, len(body), gjson.GetBytes(body, "model").String())
san := getSanitizer()
body = san.SanitizeRequest(body)
cred, err := pool.Pick()
internal/server/server.go
+72 -15
View File
@@ -1,10 +1,12 @@
package server
import (
"context"
"fmt"
"log"
"net/http"
"strings"
"sync/atomic"
"github.com/gin-gonic/gin"
@@ -14,21 +16,35 @@ import (
)
type Server struct {
engine *gin.Engine
port int
httpServer *http.Server
engine *gin.Engine
configPath string
sanitizer atomic.Pointer[proxy.Sanitizer]
apiKeys atomic.Pointer[map[string]struct{}]
}
func New(cfg *config.Config, pool *auth.Pool, profile *proxy.SniffedProfile) *Server {
s := &Server{configPath: "config.yaml"}
san := proxy.NewSanitizer(cfg.Sanitize)
s.sanitizer.Store(san)
keys := makeKeySet(cfg.APIKeys)
s.apiKeys.Store(&keys)
gin.SetMode(gin.ReleaseMode)
engine := gin.New()
engine.Use(gin.Recovery())
engine.Use(corsMiddleware())
engine.Use(authMiddleware(cfg.APIKeys))
engine.Use(s.authMiddleware())
handler := proxy.HandleMessages(pool, profile, cfg.Sanitize)
handler := proxy.HandleMessages(pool, profile, func() *proxy.Sanitizer {
return s.sanitizer.Load()
})
engine.POST("/v1/messages", handler)
engine.POST("/messages", handler)
engine.POST("/reload", s.handleReload())
engine.GET("/healthz", func(c *gin.Context) {
c.JSON(http.StatusOK, gin.H{"status": "ok"})
})
@@ -37,12 +53,56 @@ func New(cfg *config.Config, pool *auth.Pool, profile *proxy.SniffedProfile) *Se
c.JSON(http.StatusNotFound, gin.H{"error": "not found"})
})
return &Server{engine: engine, port: cfg.Port}
s.engine = engine
s.httpServer = &http.Server{
Addr: fmt.Sprintf(":%d", cfg.Port),
Handler: engine,
}
return s
}
func (s *Server) Start() error {
addr := fmt.Sprintf(":%d", s.port)
return s.engine.Run(addr)
return s.httpServer.ListenAndServe()
}
func (s *Server) Shutdown(ctx context.Context) error {
return s.httpServer.Shutdown(ctx)
}
func (s *Server) handleReload() gin.HandlerFunc {
return func(c *gin.Context) {
cfg, err := config.Load(s.configPath)
if err != nil {
c.JSON(http.StatusInternalServerError, gin.H{"error": fmt.Sprintf("load config: %v", err)})
return
}
san := proxy.NewSanitizer(cfg.Sanitize)
s.sanitizer.Store(san)
keys := makeKeySet(cfg.APIKeys)
s.apiKeys.Store(&keys)
log.Printf("config reloaded: %d tool renames, %d system rules, %d body rules, %d api keys",
len(cfg.Sanitize.Tools), len(cfg.Sanitize.System), len(cfg.Sanitize.Body), len(cfg.APIKeys))
c.JSON(http.StatusOK, gin.H{
"status": "reloaded",
"tool_renames": len(cfg.Sanitize.Tools),
"system_rules": len(cfg.Sanitize.System),
"body_rules": len(cfg.Sanitize.Body),
"api_keys": len(cfg.APIKeys),
})
}
}
func makeKeySet(apiKeys []string) map[string]struct{} {
keySet := make(map[string]struct{}, len(apiKeys))
for _, k := range apiKeys {
keySet[k] = struct{}{}
}
return keySet
}
func corsMiddleware() gin.HandlerFunc {
@@ -60,14 +120,10 @@ func corsMiddleware() gin.HandlerFunc {
}
}
func authMiddleware(apiKeys []string) gin.HandlerFunc {
keySet := make(map[string]struct{}, len(apiKeys))
for _, k := range apiKeys {
keySet[k] = struct{}{}
}
func (s *Server) authMiddleware() gin.HandlerFunc {
return func(c *gin.Context) {
if c.Request.URL.Path == "/healthz" {
path := c.Request.URL.Path
if path == "/healthz" || path == "/reload" {
c.Next()
return
}
@@ -85,7 +141,8 @@ func authMiddleware(apiKeys []string) gin.HandlerFunc {
return
}
if _, ok := keySet[token]; !ok {
keys := s.apiKeys.Load()
if _, ok := (*keys)[token]; !ok {
c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "invalid api key"})
return
}
main.go
+30 -2
View File
@@ -4,7 +4,11 @@ import (
"context"
"fmt"
"log"
"net/http"
"os"
"os/signal"
"syscall"
"time"
"github.com/fujin/anthropic-proxy/internal/auth"
"github.com/fujin/anthropic-proxy/internal/config"
@@ -33,8 +37,11 @@ func run() error {
pool := auth.NewPool(creds)
ctx, cancel := context.WithCancel(context.Background())
defer cancel()
pool.RefreshExpiring(context.Background())
auth.StartBackgroundRefresh(pool)
auth.StartBackgroundRefresh(ctx, pool)
var profile *proxy.SniffedProfile
if cfg.ClaudeBinary != "" {
@@ -47,7 +54,28 @@ func run() error {
log.Printf("starting server on port %d", cfg.Port)
srv := server.New(cfg, pool, profile)
return srv.Start()
quit := make(chan os.Signal, 1)
signal.Notify(quit, syscall.SIGINT, syscall.SIGTERM)
go func() {
<-quit
log.Printf("shutting down...")
cancel()
shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 10*time.Second)
defer shutdownCancel()
if err := srv.Shutdown(shutdownCtx); err != nil {
log.Printf("shutdown error: %v", err)
}
}()
if err := srv.Start(); err != nil && err != http.ErrServerClosed {
return err
}
return nil
}
func main() {