Support OAuth token authentication as alternative to API key

- Setup skill now asks subscription vs API key, can auto-grab token
- Debug skill updated for both auth methods
- SPEC.md documents both authentication options

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.claude/skills/debug/SKILL.md

@@ -61,13 +61,15 @@ Debug level shows:
 
 Common causes:
 
-#### Missing API Key
+#### Missing Authentication
 ```
 Invalid API key · Please run /login
 ```
-**Fix:** Ensure `.env` file exists in project root with valid `ANTHROPIC_API_KEY`:
+**Fix:** Ensure `.env` file exists with either OAuth token or API key:
 ```bash
-cat .env  # Should show: ANTHROPIC_API_KEY=sk-ant-...
+cat .env  # Should show one of:
+# CLAUDE_CODE_OAUTH_TOKEN=sk-ant-oat01-...  (subscription)
+# ANTHROPIC_API_KEY=sk-ant-api03-...        (pay-per-use)
 ```
 
 #### Root User Restriction
@@ -87,7 +89,7 @@ To verify env vars are reaching the container:
 echo '{}' | container run -i \
   --mount type=bind,source=$(pwd)/data/env,target=/workspace/env-dir,readonly \
   --entrypoint /bin/bash nanoclaw-agent:latest \
-  -c 'export $(cat /workspace/env-dir/env | xargs); echo "API key length: ${#ANTHROPIC_API_KEY}"'
+  -c 'export $(cat /workspace/env-dir/env | xargs); echo "OAuth: ${#CLAUDE_CODE_OAUTH_TOKEN} chars, API: ${#ANTHROPIC_API_KEY} chars"'
 ```
 
 ### 3. Mount Issues
@@ -111,7 +113,7 @@ container run --rm --entrypoint /bin/bash nanoclaw-agent:latest -c 'ls -la /work
 Expected structure:
 ```
 /workspace/
-├── env-dir/env     # Environment file (ANTHROPIC_API_KEY)
+├── env-dir/env     # Environment file (CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY)
 ├── group/          # Current group folder (cwd)
 ├── project/        # Project root (main channel only)
 ├── global/         # Global CLAUDE.md (non-main only)
@@ -311,8 +313,8 @@ Run this to check common issues:
 ```bash
 echo "=== Checking NanoClaw Container Setup ==="
 
-echo -e "\n1. API Key configured?"
-[ -f .env ] && grep -q "ANTHROPIC_API_KEY=sk-" .env && echo "OK" || echo "MISSING - create .env with ANTHROPIC_API_KEY"
+echo -e "\n1. Authentication configured?"
+[ -f .env ] && (grep -q "CLAUDE_CODE_OAUTH_TOKEN=sk-" .env || grep -q "ANTHROPIC_API_KEY=sk-" .env) && echo "OK" || echo "MISSING - add CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY to .env"
 
 echo -e "\n2. Env file copied for container?"
 [ -f data/env/env ] && echo "OK" || echo "MISSING - will be created on first run"

.claude/skills/setup/SKILL.md

@@ -39,44 +39,50 @@ container --version
 
 **Note:** NanoClaw automatically starts the Apple Container system when it launches, so you don't need to start it manually after reboots.
 
-## 3. Configure API Key
+## 3. Configure Claude Authentication
 
 Ask the user:
-> Do you have an Anthropic API key configured elsewhere that I should copy, or should I create a `.env` file for you to fill in?
+> Do you want to use your **Claude subscription** (Pro/Max) or an **Anthropic API key**?
 
-**If copying from another location:**
-```bash
-# Extract only the ANTHROPIC_API_KEY line from the source file
-grep "^ANTHROPIC_API_KEY=" /path/to/other/.env > .env
-```
+### Option 1: Claude Subscription (Recommended)
 
-Verify the key exists (only show first/last few chars for security):
+Ask the user:
+> Want me to grab the OAuth token from your current Claude session?
+
+If yes:
 ```bash
-KEY=$(grep "^ANTHROPIC_API_KEY=" .env | cut -d= -f2)
-if [ -n "$KEY" ]; then
-  echo "API key configured: ${KEY:0:10}...${KEY: -4}"
+TOKEN=$(cat ~/.claude/.credentials.json 2>/dev/null | jq -r '.claudeAiOauth.accessToken // empty')
+if [ -n "$TOKEN" ]; then
+  echo "CLAUDE_CODE_OAUTH_TOKEN=$TOKEN" > .env
+  echo "Token configured: ${TOKEN:0:20}...${TOKEN: -4}"
 else
-  echo "API key missing or invalid"
+  echo "No token found - are you logged in to Claude Code?"
 fi
 ```
 
-**If creating new:**
+If the token wasn't found, tell the user:
+> Run `claude` in another terminal and log in first, then come back here.
+
+### Option 2: API Key
+
+Ask if they have an existing key to copy or need to create one.
+
+**Copy existing:**
+```bash
+grep "^ANTHROPIC_API_KEY=" /path/to/source/.env > .env
+```
+
+**Create new:**
 ```bash
 echo 'ANTHROPIC_API_KEY=' > .env
 ```
 
-Tell the user:
-> I've created `.env` in the project root. Please add your Anthropic API key after the `=` sign.
-> You can get an API key from https://console.anthropic.com/
+Tell the user to add their key from https://console.anthropic.com/
 
-Wait for user confirmation, then verify (only show first/last few chars):
+**Verify:**
 ```bash
 KEY=$(grep "^ANTHROPIC_API_KEY=" .env | cut -d= -f2)
-if [ -n "$KEY" ]; then
-  echo "API key configured: ${KEY:0:10}...${KEY: -4}"
-else
-  echo "API key missing or invalid"
-fi
+[ -n "$KEY" ] && echo "API key configured: ${KEY:0:10}...${KEY: -4}" || echo "Missing"
 ```
 
 ## 4. Build Container Image