Module anthropic_profile 

Anthropic OAuth profile lookup: the seat identity behind a Claude credential.

Anthropic access tokens are opaque (no JWT claims), so unlike Codex the account behind a credential cannot be read off the token. The only source is the read-only GET /api/oauth/profile endpoint, which returns the account.uuid (the quota-bearing entity) plus display metadata.

Same design rules as super::usage:

• Read-only, pinned destination. One GET to a constant URL. The only override is a loopback-only test seam that is rejected for any other host, so a bearer token can never be coaxed toward another destination.
• Bounded time and body. Per-request timeout; the body is streamed into a capped buffer and dropped on overflow.
• Sanitized errors. No error string ever contains the token, the URL query, or a byte of an upstream body. Parse errors use a fixed vocabulary — never raw upstream key names or values.
• No token material in the result. AnthropicProfile holds only identity fields.

Structs

AnthropicProfile

Non-secret identity of the Claude account behind an OAuth credential. account_uuid is the seat identity used for duplicate detection.

Constants

ANTHROPIC_OAUTH_BETA

Beta header every Anthropic OAuth API call carries. Must stay identical to the (private) constant of the same name in usage.rs.

ANTHROPIC_PROFILE_URL

Pinned Anthropic OAuth profile endpoint.

PROFILE_MAX_BODY_BYTES

Hard cap on a buffered profile body. Real payloads are under 2 KiB.

PROFILE_REQUEST_TIMEOUT

Total time budget for one profile request.

Functions

fetch_anthropic_profile

GET the profile for access_token and parse it. endpoint_override is a loopback-only test seam. The caller’s client should follow no redirects (see super::identity::identity_http_client); a 3xx is an error here regardless. Errors never contain the token or upstream bytes.

parse_anthropic_profile

Pure parser for the profile body. Fails closed when account.uuid is missing, empty, non-string or over-long; every other field is optional and unknown/null fields are ignored.