All Articles
Drop Your Static Claude API Keys: Moving CI and Production to Keyless Auth with Workload Identity Federation
Workload Identity Federation is now generally available on the Claude Platform. This guide walks through replacing long-lived sk-ant- keys with short-lived OIDC tokens, including keyless GitHub Actions auth, the migration steps, and token refresh design.
When Your Claude API Cost Math Doesn't Match the Bill: Accounting for the Four Token Buckets
Turn on prompt caching and your homegrown cost tally drifts from the console bill. Here is how to weight the four token buckets the usage object returns and build a ledger you can reconcile.
Claude API Streaming Breaks the "Everything Arrives" Assumption — Field Notes on Recovering from Partial Failure
Once concurrency climbs, Claude API streams disconnect mid-response, replay events, and emit half-finished tool arguments. Treating partial failure as the norm rather than an anomaly, here is how I rebuilt the implementation and monitoring to recover quietly.
Putting a Ceiling on the pause_turn Loop: Running Long Server Tools Safely Unattended
A production design for continuing pause_turn safely in unattended runs, where long server tools like web_search and code execution are involved. Covers branching all four stop_reason values in one loop, capping continuations and wall-clock time, and accumulating usage across paused segments.
Surviving the 90-Second Code Execution Cell Limit with Checkpointed Chunking
Claude's code execution tool now enforces a 90-second per-cell limit. Here is how to keep a long batch from getting cut off there: persist progress to the container filesystem and resume across cells, with working code for timing, idempotent checkpoints, and knowing when to offload.
Why Cowork's bash Says 'No Such File' When Finder Shows It Right There
Connect a cloud-synced folder to Cowork and bash sees empty placeholders while cat fails. Here is how on-demand materialization actually works, and the design patterns that keep your automations from silently dropping data.
Connecting Managed Agents to Services You Don't Want to Expose: MCP Tunnel Design
How to connect Claude Managed Agents to an internal MCP server that is never exposed to the public internet. We cover the MCP tunnel, self-hosted sandboxes, authorization boundaries, and graceful degradation when things break.
Don't Carry Search Results Twice: Trimming Consumed Blocks with response_inclusion
When an agent runs dynamic filtering, output tokens balloon because the raw search-result blocks a code execution call already consumed get echoed back into the response. Here is when response_inclusion: excluded is safe to use, when you must keep full, with implementation and a decision table.
When Claude Code Still Writes Stale Code With Context7 Installed — Verifying the Injection Actually Worked
You installed Context7 MCP, yet Claude returns code against a deprecated API. Most of the time the documentation injection silently no-ops. Here are field notes on a hook that detects misses, pinning doc versions, and a harness that checks generated code every time.
Reserving Priority Capacity for User Traffic with service_tier
If you pay for Priority Tier but your user-facing responses still slow down at peak, the culprit is often your own background jobs eating the priority pool. Here is how to read service_tier, prove the contention, and isolate background work.
Routing the effort Parameter Per Stage to Balance Claude's Output Cost and Latency
Claude's effort parameter governs all output tokens — thinking, prose, and tool calls. This guide replaces a blanket high setting with per-stage tiers and a dynamic router, grounded in measurements from a solo developer's automation pipeline.
Running Subagents in Parallel Without One Failure Sinking the Whole Run
A fan-out / fan-in design for running several subagents in parallel, covering token budgeting, a result contract, and partial-failure handling. Includes an implementation where one branch can fail without stopping the rest, plus measured numbers.