fix: add browser headers to all API requests to resolve 403 on usage endpoint

Claude's usage/prepaid/overage endpoints require Origin, Referer, and
User-Agent headers to pass CORS/auth checks. Without them, bootstrap
succeeds (more permissive) but usage returns 403 -> 'Not signed in'.

Added claudeAPIRequest(for:) helper that sets all required browser-like
headers on every request. Bootstrap, usage, prepaid, overage, and the
orgs fallback all go through it.

ClaudeChecker/ContentView.swift

@@ -40,8 +40,7 @@ struct ContentView: View {
                         .environmentObject(updater)
                         .transition(.move(edge: .trailing).combined(with: .opacity))
                 } else {
-                    ScrollView(.vertical, showsIndicators: false) {
-                        VStack(spacing: 0) {
+                    VStack(spacing: 0) {
                             // Cards grid
                             if vm.limits.isEmpty {
                                 EmptyStateView()
@@ -96,7 +95,6 @@ struct ContentView: View {
                                         .padding(.bottom, 8)
                                 }
                             }
-                        }
                     }
                     .transition(.opacity)
 
@@ -913,12 +911,12 @@ struct ErrorBanner: View {
 struct EmptyStateView: View {
     var body: some View {
         VStack(spacing: 10) {
-            Image(systemName: "key.slash")
+            Image(systemName: "person.crop.circle.badge.questionmark")
                 .font(.system(size: 28))
                 .foregroundColor(.secondary)
-            Text("No API key configured")
+            Text("Not signed in")
                 .font(.system(size: 13, weight: .medium))
-            Text("Open Settings to add your Anthropic API key.")
+            Text("Sign in to claude.ai to see your usage.")
                 .font(.system(size: 11.5))
                 .foregroundColor(.secondary)
                 .multilineTextAlignment(.center)

ClaudeChecker/Info.plist

@@ -15,9 +15,9 @@
     <key>CFBundlePackageType</key>
     <string>APPL</string>
     <key>CFBundleShortVersionString</key>
-    <string>1.1.4-beta.6</string>
+    <string>1.2.1-beta.6</string>
     <key>CFBundleVersion</key>
-    <string>46</string>
+    <string>54</string>
     <key>LSMinimumSystemVersion</key>
     <string>13.0</string>
     <key>LSUIElement</key>

ClaudeChecker/LoginView.swift

@@ -36,12 +36,10 @@ struct LoginWebView: NSViewRepresentable {
             if let url = webView.url?.absoluteString,
                url.contains("/login") || url.contains("/auth") { return }
 
+            // URL is not a login/auth page, so if any claude.ai cookie exists we're signed in
             WKWebsiteDataStore.default().httpCookieStore.getAllCookies { cookies in
-                let hasSession = cookies.contains {
-                    $0.domain.contains("claude.ai") &&
-                    ($0.name == "sessionKey" || $0.name == "__Secure-next-auth.session-token")
-                }
-                guard hasSession, !self.didAuthenticate else { return }
+                let hasAnyCookie = cookies.contains { $0.domain.contains("claude.ai") }
+                guard hasAnyCookie, !self.didAuthenticate else { return }
                 self.didAuthenticate = true
                 DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) {
                     self.onAuthenticated()

ClaudeChecker/UsageViewModel.swift

@@ -38,6 +38,13 @@ class UsageViewModel: ObservableObject {
             burnHistoryStore = saved
         }
         loadPlaceholderData()
+        Task { await checkInitialSignInState() }
+    }
+
+    private func checkInitialSignInState() async {
+        let cookies = await WKWebsiteDataStore.default().httpCookieStore.allCookies()
+        let hasAnyCookie = cookies.contains { $0.domain.contains("claude.ai") }
+        if hasAnyCookie { isSignedIn = true }
     }
 
     func signOut() async {
@@ -121,12 +128,25 @@ class UsageViewModel: ObservableObject {
 
     // MARK: - Bootstrap (org ID + email + plan label in one call)
 
+    private func claudeAPIRequest(for url: URL) async -> URLRequest {
+        var req = URLRequest(url: url)
+        req.setValue("application/json, text/plain, */*", forHTTPHeaderField: "accept")
+        req.setValue("Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36", forHTTPHeaderField: "User-Agent")
+        req.setValue("https://claude.ai", forHTTPHeaderField: "Origin")
+        req.setValue("https://claude.ai/", forHTTPHeaderField: "Referer")
+        req.setValue("same-origin", forHTTPHeaderField: "sec-fetch-site")
+        req.setValue("cors", forHTTPHeaderField: "sec-fetch-mode")
+        req.setValue("empty", forHTTPHeaderField: "sec-fetch-dest")
+        if let cookie = await claudeCookieHeader() {
+            req.setValue(cookie, forHTTPHeaderField: "Cookie")
+        }
+        return req
+    }
+
     private func fetchBootstrap() async throws -> (orgId: String?, email: String?, planLabel: String?) {
         let url = URL(string: "https://claude.ai/api/bootstrap")!
-        var req = URLRequest(url: url)
-        req.setValue("application/json", forHTTPHeaderField: "accept")
-        guard let cookie = await claudeCookieHeader() else { throw AppError.notAuthenticated }
-        req.setValue(cookie, forHTTPHeaderField: "Cookie")
+        var req = await claudeAPIRequest(for: url)
+        guard req.value(forHTTPHeaderField: "Cookie") != nil else { throw AppError.notAuthenticated }
         let (data, response) = try await URLSession.shared.data(for: req)
         guard let http = response as? HTTPURLResponse else { throw AppError.networkError }
         if http.statusCode == 401 || http.statusCode == 403 { throw AppError.notAuthenticated }
@@ -140,11 +160,20 @@ class UsageViewModel: ObservableObject {
         let memberships = (account?["memberships"] ?? json["memberships"]) as? [[String: Any]]
         let firstOrg = memberships?.first?["organization"] as? [String: Any]
 
-        // org ID — primary path then flat-list fallback
+        // org ID — primary path then flat-list fallback then dedicated endpoint
         var orgId: String? = firstOrg?["uuid"] as? String
         if orgId == nil {
             orgId = (json["organizations"] as? [[String: Any]])?.first?["uuid"] as? String
         }
+        if orgId == nil {
+            // Final fallback: fetch /api/organizations directly
+            let orgsReq = await claudeAPIRequest(for: URL(string: "https://claude.ai/api/organizations")!)
+            if let (orgsData, orgsResp) = try? await URLSession.shared.data(for: orgsReq),
+               let orgsHttp = orgsResp as? HTTPURLResponse, orgsHttp.statusCode == 200,
+               let orgs = try? JSONSerialization.jsonObject(with: orgsData) as? [[String: Any]] {
+                orgId = orgs.first?["uuid"] as? String
+            }
+        }
 
         let email = account?["email_address"] as? String
 
@@ -169,9 +198,7 @@ class UsageViewModel: ObservableObject {
 
     private func fetchUsage(orgId: String) async throws -> UsageResponse {
         let url = URL(string: "https://claude.ai/api/organizations/\(orgId)/usage")!
-        var req = URLRequest(url: url)
-        req.setValue("application/json", forHTTPHeaderField: "accept")
-        if let cookie = await claudeCookieHeader() { req.setValue(cookie, forHTTPHeaderField: "Cookie") }
+        let req = await claudeAPIRequest(for: url)
         let (data, response) = try await URLSession.shared.data(for: req)
         guard let http = response as? HTTPURLResponse else { throw AppError.networkError }
         if http.statusCode == 401 || http.statusCode == 403 { throw AppError.notAuthenticated }
@@ -181,9 +208,7 @@ class UsageViewModel: ObservableObject {
 
     private func fetchPrepaidCredits(orgId: String) async throws -> PrepaidCredits? {
         let url = URL(string: "https://claude.ai/api/organizations/\(orgId)/prepaid/credits")!
-        var req = URLRequest(url: url)
-        req.setValue("application/json", forHTTPHeaderField: "accept")
-        if let cookie = await claudeCookieHeader() { req.setValue(cookie, forHTTPHeaderField: "Cookie") }
+        let req = await claudeAPIRequest(for: url)
         let (data, response) = try await URLSession.shared.data(for: req)
         guard let http = response as? HTTPURLResponse, http.statusCode == 200 else { return nil }
         return try? JSONDecoder().decode(PrepaidCredits.self, from: data)
@@ -191,9 +216,7 @@ class UsageViewModel: ObservableObject {
 
     private func fetchOverageSpendLimit(orgId: String) async throws -> OverageSpendLimit? {
         let url = URL(string: "https://claude.ai/api/organizations/\(orgId)/overage_spend_limit")!
-        var req = URLRequest(url: url)
-        req.setValue("application/json", forHTTPHeaderField: "accept")
-        if let cookie = await claudeCookieHeader() { req.setValue(cookie, forHTTPHeaderField: "Cookie") }
+        let req = await claudeAPIRequest(for: url)
         let (data, response) = try await URLSession.shared.data(for: req)
         guard let http = response as? HTTPURLResponse, http.statusCode == 200 else { return nil }
         return try? JSONDecoder().decode(OverageSpendLimit.self, from: data)

README.md

@@ -8,9 +8,9 @@
 
 [![macOS](https://img.shields.io/badge/macOS-13.0+-000000?style=flat&logo=apple&logoColor=white)](https://www.apple.com/macos/)
 [![Swift](https://img.shields.io/badge/Swift-5.9-F05138?style=flat&logo=swift&logoColor=white)](https://swift.org)
-[![Version](https://img.shields.io/badge/version-1.1.3-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases)
+[![Version](https://img.shields.io/badge/version-1.2.0-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases)
 [![License](https://img.shields.io/badge/license-MIT-blue?style=flat)](LICENSE)
-[![Beta](https://img.shields.io/badge/beta-1.1.4--beta.5-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases/tag/v1.1.4-beta.5) <!-- BETA_BADGE -->
+[![Beta](https://img.shields.io/badge/beta-1.2.1--beta.5-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases/tag/v1.2.1-beta.5) <!-- BETA_BADGE -->
 
 </div>
 

RELEASE_NOTES.md

@@ -1,4 +1,9 @@
-## What's new in v1.1.4-beta.6
+## What's new in v1.2.1
 
-### UI improvement
-- Session Diary card: removed the Claude icon and header row; now shows sample count and avg burn rate left/right with the sparkline below — matching the cleaner Windows layout
+### Bug fixes
+- Fixed "Not signed in" showing incorrectly on launch when the session was already active
+- Sign-in state is now detected immediately from stored cookies on startup, before the first data refresh completes
+- Fixed login window auto-closing before the user could sign in — the login window now correctly loads the `/login` page so it only detects auth after the actual sign-in redirect
+- Fixed "No API key configured" showing after signing out — now correctly shows "Not signed in" with a prompt to sign in
+- Added `/api/organizations` as a final fallback for org ID resolution when the bootstrap API response doesn't include it
+- Fixed usage data not loading after sign-in — API requests now include required browser-like headers (Origin, Referer, User-Agent) that Claude's usage endpoints require

version-beta.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.1.4-beta.5",
-  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.1.4-beta.5/ClaudeChecker.zip",
-  "notes": "## What's new in v1.1.4-beta.5\n\n### Improvements\n- Bootstrap API call consolidated — org ID, email, and plan name now fetched in a single request per refresh"
+  "version": "1.2.1-beta.5",
+  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.2.1-beta.5/ClaudeChecker.zip",
+  "notes": "## What's new in v1.2.1\n\n### Bug fixes\n- Fixed \"Not signed in\" showing incorrectly on launch when the session was already active\n- Sign-in state is now detected immediately from stored cookies on startup, before the first data refresh completes\n- Fixed login window auto-closing before the user could sign in — the login window now correctly loads the `/login` page so it only detects auth after the actual sign-in redirect\n- Fixed \"No API key configured\" showing after signing out — now correctly shows \"Not signed in\" with a prompt to sign in\n- Added `/api/organizations` as a final fallback for org ID resolution when the bootstrap API response doesn't include it"
 }

version.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.1.3",
-  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.1.3/ClaudeChecker.zip",
-  "notes": "## What's new in v1.1.3\n\n### UI polish\n- Limit headers now read \"5 Hour Limit\" and \"7 Day Limit\"\n- Tapping anywhere on the blue update banner opens the update window\n\n### Session Diary fix\n- Burn history is persisted across app launches — the sparkline populates immediately on first open instead of requiring a manual refresh\n\n### Window sizing fixes\n- The popover now resizes correctly when switching between the main view and settings\n- Background colour no longer shows through during the resize animation"
+  "version": "1.2.0",
+  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.2.0/ClaudeChecker.zip",
+  "notes": "## What's new in v1.2.0\n\n### Bug fixes\n- App now works for all users — org ID is fetched dynamically from the API instead of being hardcoded\n- Plan name (e.g. Pro, Max) now updates correctly on every refresh\n\n### Improvements\n- Plan name is read from the API rather than hardcoded\n- Bootstrap API call consolidated — org ID, email, and plan name fetched in a single request per refresh\n- Main panel no longer scrolls — popover auto-sizes to fit content\n- Session Diary card redesigned — sample count and avg burn rate shown left/right above the sparkline, Claude header removed"
 }