Authenticate the Claude Adapter

The nvidia.fabric.claude adapter uses the Claude Agent SDK and its bundled Claude Code runtime. NeMo Fabric preserves Claude’s native credential precedence and forwards only supported operating-system, configuration, and authentication variables plus values explicitly configured in environment.env.

The adapter package’s harness and full extras pin claude-agent-sdk==0.2.120. Use the same version for an environment-managed SDK. The SDK owns and selects its compatible Claude Code runtime.

Install the Adapter

To install the NeMo Fabric runtime, Claude adapter, and supported Claude Agent SDK in one environment:

$
pip install "nemo-fabric[claude]"

To install the adapter and supported Claude Agent SDK without the NeMo Fabric runtime, use the adapter package’s harness extra:

$
pip install "nemo-fabric-adapters-claude[harness]"

The adapter package’s full extra installs the same dependencies as harness; it does not install the NeMo Fabric runtime. Claude Relay integration uses the external nemo-relay CLI, not the Python nemo-relay package, so this adapter does not provide a relay extra. Follow the NeMo Relay CLI installation procedure, then ensure nemo-relay is on PATH.

If the environment already manages a compatible Claude Agent SDK, install only the adapter:

$
pip install nemo-fabric-adapters-claude

The bare adapter package does not install the NeMo Fabric runtime or SDK.

If the existing compatible Claude Agent SDK and NeMo Fabric runtime share an environment, install the runtime and bare adapter together:

$
pip install nemo-fabric nemo-fabric-adapters-claude

For separate environments, set ADAPTER_PYTHON in the runtime environment to the adapter environment’s Python interpreter. Use matching NeMo Fabric release versions for the runtime and adapter package unless a different pairing has been explicitly validated.

Configure the Adapter

Select the Claude harness integration in HarnessConfig:

1
from nemo_fabric import HarnessConfig
2
3
harness = HarnessConfig(adapter_id="nvidia.fabric.claude")

Use normalized FabricConfig fields to configure the model, workspace, skills, MCP servers, instructions, turn limit, tool policy, and telemetry. The resolved Claude descriptor accepts only these Claude-specific harness.settings keys:

• permission_mode: default, acceptEdits, bypassPermissions, plan, dontAsk, or auto
• max_budget_usd: a number greater than 0
• setting_sources: an array containing user, project, or local

Planning rejects unknown keys, invalid types, and invalid values before the Claude runtime starts. When permission_mode is dontAsk, tools listed in tools.enabled are pre-approved so headless runs can invoke them.

Choose an Authentication Mode

Use the mode that matches the execution environment:

Claude Code selects ANTHROPIC_AUTH_TOKEN before ANTHROPIC_API_KEY. Both environment credentials take precedence over WIF and cached login credentials. An empty value still occupies its precedence slot, so unset an unused variable instead of setting it to an empty string.

Claude Code can use a Claude.ai Pro or Max login, an Anthropic Console login, or supported enterprise providers. Refer to the Claude Code authentication documentation for the current subscription and enterprise options.

Use a Cached Claude Code Login

Authenticate Claude Code outside NeMo Fabric. The adapter inherits HOME and CLAUDE_CONFIG_DIR, so the bundled runtime can reuse the same cached login. NeMo Fabric does not copy the credential store into its configuration or artifacts.

Use an API Key

Set the API key in the process that invokes NeMo Fabric:

$
export ANTHROPIC_API_KEY=sk-ant-api03-example

The adapter also forwards the selected model’s api_key_env when the model configuration names a different environment variable.

Use a Compatible Custom Provider

Use provider="anthropic" for Claude’s native authentication and endpoint discovery. For another provider name, set both api_key_env and base_url. The configured endpoint must implement the Anthropic Messages protocol. NeMo Fabric maps the named credential and endpoint into Claude Code’s environment; it does not maintain a provider-name allowlist or infer provider endpoints.

Use Workload Identity Federation

For a named WIF profile, set the profile and optional nondefault configuration directory:

$
export ANTHROPIC_CONFIG_DIR=/etc/anthropic
$
export ANTHROPIC_PROFILE=production

For direct environment configuration, provide the federation rule, organization, service account, and one identity-token source:

$
export ANTHROPIC_FEDERATION_RULE_ID=fdrl_example
$
export ANTHROPIC_ORGANIZATION_ID=00000000-0000-0000-0000-000000000000
$
export ANTHROPIC_SERVICE_ACCOUNT_ID=svac_example
$
export ANTHROPIC_WORKSPACE_ID=wrkspc_example
$
export ANTHROPIC_IDENTITY_TOKEN_FILE=/var/run/secrets/anthropic.com/token

Use ANTHROPIC_IDENTITY_TOKEN instead of ANTHROPIC_IDENTITY_TOKEN_FILE when the platform injects the identity token as an environment variable. Refer to the Anthropic WIF reference for credential precedence, profile structure, required claims, and provider setup.

Unset ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN before using WIF. These variables take precedence over federation even when their value is empty.

Use Authentication with Relay

NeMo Relay does not authenticate Claude. A Relay-enabled NeMo Fabric runtime starts one gateway as a supervised sidecar, sets ANTHROPIC_BASE_URL for the Claude runtime, passes an explicit selected model endpoint to the gateway as its Anthropic upstream, and reuses the gateway across ordered invocations. Fabric.run(...) starts the same runtime, invokes it once, and stops it, so the gateway is scoped to that single invocation. Claude still resolves its credential through the selected mode, and NeMo Fabric does not write authentication values to Relay configuration or artifacts.

NeMo Fabric supports the external NeMo Relay CLI from 0.6.0 up to, but not including, 0.7.0. The Python package named nemo-relay does not install this CLI. NeMo Fabric owns sidecar supervision, Claude configuration, and upstream selection. Relay owns the gateway transport and semantic observability pipeline.