fix: include anthropic.com cookies in all auth checks and API requests

Claude session cookies are on anthropic.com, not claude.ai. The login
window was not detecting auth (Cancel stayed, no Done) and API calls
were sent without the actual session token.

- claudeCookieHeader: include anthropic.com cookies so the token is
  sent to the usage/bootstrap endpoints
- checkInitialSignInState: detect anthropic.com cookies on startup
- didFinish in LoginView: fire auth when anthropic.com cookies found
- signOut: clear anthropic.com data alongside claude.ai
- notAuthenticated catch: set isSignedIn = false so Settings stays
  in sync with the main panel

ClaudeChecker/ContentView.swift

@@ -911,12 +911,12 @@ struct ErrorBanner: View {
 struct EmptyStateView: View {
     var body: some View {
         VStack(spacing: 10) {
-            Image(systemName: "key.slash")
+            Image(systemName: "person.crop.circle.badge.questionmark")
                 .font(.system(size: 28))
                 .foregroundColor(.secondary)
-            Text("No API key configured")
+            Text("Not signed in")
                 .font(.system(size: 13, weight: .medium))
-            Text("Open Settings to add your Anthropic API key.")
+            Text("Sign in to claude.ai to see your usage.")
                 .font(.system(size: 11.5))
                 .foregroundColor(.secondary)
                 .multilineTextAlignment(.center)

ClaudeChecker/Info.plist

@@ -15,9 +15,9 @@
     <key>CFBundlePackageType</key>
     <string>APPL</string>
     <key>CFBundleShortVersionString</key>
-    <string>1.2.1-beta.1</string>
+    <string>1.2.1-beta.7</string>
     <key>CFBundleVersion</key>
-    <string>49</string>
+    <string>55</string>
     <key>LSMinimumSystemVersion</key>
     <string>13.0</string>
     <key>LSUIElement</key>

ClaudeChecker/LoginView.swift

@@ -36,12 +36,10 @@ struct LoginWebView: NSViewRepresentable {
             if let url = webView.url?.absoluteString,
                url.contains("/login") || url.contains("/auth") { return }
 
+            // URL is not a login/auth page, so if any claude.ai cookie exists we're signed in
             WKWebsiteDataStore.default().httpCookieStore.getAllCookies { cookies in
-                let hasSession = cookies.contains {
+                let hasAnyCookie = cookies.contains { $0.domain.contains("claude.ai") || $0.domain.contains("anthropic.com") }
-                    $0.domain.contains("claude.ai") &&
+                guard hasAnyCookie, !self.didAuthenticate else { return }
-                    ($0.name == "sessionKey" || $0.name == "__Secure-next-auth.session-token")
-                }
-                guard hasSession, !self.didAuthenticate else { return }
                 self.didAuthenticate = true
                 DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) {
                     self.onAuthenticated()

ClaudeChecker/UsageViewModel.swift

@@ -43,18 +43,15 @@ class UsageViewModel: ObservableObject {
 
     private func checkInitialSignInState() async {
         let cookies = await WKWebsiteDataStore.default().httpCookieStore.allCookies()
-        let hasSession = cookies.contains {
+        let hasAnyCookie = cookies.contains { $0.domain.contains("claude.ai") || $0.domain.contains("anthropic.com") }
-            $0.domain.contains("claude.ai") &&
+        if hasAnyCookie { isSignedIn = true }
-            ($0.name == "sessionKey" || $0.name == "__Secure-next-auth.session-token")
-        }
-        if hasSession { isSignedIn = true }
     }
 
     func signOut() async {
         let store = WKWebsiteDataStore.default()
         let types = WKWebsiteDataStore.allWebsiteDataTypes()
         let records = await store.dataRecords(ofTypes: types)
-        let claudeRecords = records.filter { $0.displayName.contains("claude.ai") }
+        let claudeRecords = records.filter { $0.displayName.contains("claude.ai") || $0.displayName.contains("anthropic.com") }
         await store.removeData(ofTypes: types, for: claudeRecords)
         UserDefaults.standard.removeObject(forKey: "claude_org_id")
         isSignedIn = false
@@ -112,6 +109,7 @@ class UsageViewModel: ObservableObject {
             checkLimitNotifications(for: limits)
         } catch AppError.notAuthenticated {
             isNotAuthenticated = true
+            isSignedIn = false
             errorMessage = "Not signed in"
         } catch let error as DecodingError {
             switch error {
@@ -131,12 +129,25 @@ class UsageViewModel: ObservableObject {
 
     // MARK: - Bootstrap (org ID + email + plan label in one call)
 
+    private func claudeAPIRequest(for url: URL) async -> URLRequest {
+        var req = URLRequest(url: url)
+        req.setValue("application/json, text/plain, */*", forHTTPHeaderField: "accept")
+        req.setValue("Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36", forHTTPHeaderField: "User-Agent")
+        req.setValue("https://claude.ai", forHTTPHeaderField: "Origin")
+        req.setValue("https://claude.ai/", forHTTPHeaderField: "Referer")
+        req.setValue("same-origin", forHTTPHeaderField: "sec-fetch-site")
+        req.setValue("cors", forHTTPHeaderField: "sec-fetch-mode")
+        req.setValue("empty", forHTTPHeaderField: "sec-fetch-dest")
+        if let cookie = await claudeCookieHeader() {
+            req.setValue(cookie, forHTTPHeaderField: "Cookie")
+        }
+        return req
+    }
+
     private func fetchBootstrap() async throws -> (orgId: String?, email: String?, planLabel: String?) {
         let url = URL(string: "https://claude.ai/api/bootstrap")!
-        var req = URLRequest(url: url)
+        var req = await claudeAPIRequest(for: url)
-        req.setValue("application/json", forHTTPHeaderField: "accept")
+        guard req.value(forHTTPHeaderField: "Cookie") != nil else { throw AppError.notAuthenticated }
-        guard let cookie = await claudeCookieHeader() else { throw AppError.notAuthenticated }
-        req.setValue(cookie, forHTTPHeaderField: "Cookie")
         let (data, response) = try await URLSession.shared.data(for: req)
         guard let http = response as? HTTPURLResponse else { throw AppError.networkError }
         if http.statusCode == 401 || http.statusCode == 403 { throw AppError.notAuthenticated }
@@ -155,11 +166,9 @@ class UsageViewModel: ObservableObject {
         if orgId == nil {
             orgId = (json["organizations"] as? [[String: Any]])?.first?["uuid"] as? String
         }
-        if orgId == nil, let cookie = await claudeCookieHeader() {
+        if orgId == nil {
             // Final fallback: fetch /api/organizations directly
-            var orgsReq = URLRequest(url: URL(string: "https://claude.ai/api/organizations")!)
+            let orgsReq = await claudeAPIRequest(for: URL(string: "https://claude.ai/api/organizations")!)
-            orgsReq.setValue("application/json", forHTTPHeaderField: "accept")
-            orgsReq.setValue(cookie, forHTTPHeaderField: "Cookie")
             if let (orgsData, orgsResp) = try? await URLSession.shared.data(for: orgsReq),
                let orgsHttp = orgsResp as? HTTPURLResponse, orgsHttp.statusCode == 200,
                let orgs = try? JSONSerialization.jsonObject(with: orgsData) as? [[String: Any]] {
@@ -184,15 +193,13 @@ class UsageViewModel: ObservableObject {
 
     private func claudeCookieHeader() async -> String? {
         let cookies = await WKWebsiteDataStore.default().httpCookieStore.allCookies()
-        let claudeCookies = cookies.filter { $0.domain.contains("claude.ai") }
+        let claudeCookies = cookies.filter { $0.domain.contains("claude.ai") || $0.domain.contains("anthropic.com") }
         return HTTPCookie.requestHeaderFields(with: claudeCookies)["Cookie"]
     }
 
     private func fetchUsage(orgId: String) async throws -> UsageResponse {
         let url = URL(string: "https://claude.ai/api/organizations/\(orgId)/usage")!
-        var req = URLRequest(url: url)
+        let req = await claudeAPIRequest(for: url)
-        req.setValue("application/json", forHTTPHeaderField: "accept")
-        if let cookie = await claudeCookieHeader() { req.setValue(cookie, forHTTPHeaderField: "Cookie") }
         let (data, response) = try await URLSession.shared.data(for: req)
         guard let http = response as? HTTPURLResponse else { throw AppError.networkError }
         if http.statusCode == 401 || http.statusCode == 403 { throw AppError.notAuthenticated }
@@ -202,9 +209,7 @@ class UsageViewModel: ObservableObject {
 
     private func fetchPrepaidCredits(orgId: String) async throws -> PrepaidCredits? {
         let url = URL(string: "https://claude.ai/api/organizations/\(orgId)/prepaid/credits")!
-        var req = URLRequest(url: url)
+        let req = await claudeAPIRequest(for: url)
-        req.setValue("application/json", forHTTPHeaderField: "accept")
-        if let cookie = await claudeCookieHeader() { req.setValue(cookie, forHTTPHeaderField: "Cookie") }
         let (data, response) = try await URLSession.shared.data(for: req)
         guard let http = response as? HTTPURLResponse, http.statusCode == 200 else { return nil }
         return try? JSONDecoder().decode(PrepaidCredits.self, from: data)
@@ -212,9 +217,7 @@ class UsageViewModel: ObservableObject {
 
     private func fetchOverageSpendLimit(orgId: String) async throws -> OverageSpendLimit? {
         let url = URL(string: "https://claude.ai/api/organizations/\(orgId)/overage_spend_limit")!
-        var req = URLRequest(url: url)
+        let req = await claudeAPIRequest(for: url)
-        req.setValue("application/json", forHTTPHeaderField: "accept")
-        if let cookie = await claudeCookieHeader() { req.setValue(cookie, forHTTPHeaderField: "Cookie") }
         let (data, response) = try await URLSession.shared.data(for: req)
         guard let http = response as? HTTPURLResponse, http.statusCode == 200 else { return nil }
         return try? JSONDecoder().decode(OverageSpendLimit.self, from: data)

README.md

@@ -10,7 +10,7 @@
 [![Swift](https://img.shields.io/badge/Swift-5.9-F05138?style=flat&logo=swift&logoColor=white)](https://swift.org)
 [![Version](https://img.shields.io/badge/version-1.2.0-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases)
 [![License](https://img.shields.io/badge/license-MIT-blue?style=flat)](LICENSE)
-<!-- BETA_BADGE -->
+[![Beta](https://img.shields.io/badge/beta-1.2.1--beta.6-orange?style=flat)](https://github.com/superdooper86/claudechecker/releases/tag/v1.2.1-beta.6) <!-- BETA_BADGE -->
 
 </div>
 

RELEASE_NOTES.md

@@ -3,5 +3,9 @@
 ### Bug fixes
 - Fixed "Not signed in" showing incorrectly on launch when the session was already active
 - Sign-in state is now detected immediately from stored cookies on startup, before the first data refresh completes
+- Fixed login window auto-closing before the user could sign in — the login window now correctly loads the `/login` page so it only detects auth after the actual sign-in redirect
+- Fixed "No API key configured" showing after signing out — now correctly shows "Not signed in" with a prompt to sign in
 - Added `/api/organizations` as a final fallback for org ID resolution when the bootstrap API response doesn't include it
-- Session cookie detection now checks both `sessionKey` and `__Secure-next-auth.session-token` cookie names
+- Fixed usage data not loading — API requests now include required browser-like headers (Origin, Referer, User-Agent)
+- Fixed sign-in detection and cookie handling for accounts whose session cookies are on the `anthropic.com` domain rather than `claude.ai`
+- Fixed Settings incorrectly showing "Signed in" after a failed refresh — sign-in state now resets when authentication fails

version-beta.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.1.4-beta.7",
+  "version": "1.2.1-beta.6",
-  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.1.4-beta.7/ClaudeChecker.zip",
+  "url": "https://github.com/superdooper86/claudechecker/releases/download/v1.2.1-beta.6/ClaudeChecker.zip",
-  "notes": "## What's new in v1.1.4-beta.7\n\n### Bug fix\n- Main panel no longer scrolls — popover now auto-sizes to fit content"
+  "notes": "## What's new in v1.2.1\n\n### Bug fixes\n- Fixed \"Not signed in\" showing incorrectly on launch when the session was already active\n- Sign-in state is now detected immediately from stored cookies on startup, before the first data refresh completes\n- Fixed login window auto-closing before the user could sign in — the login window now correctly loads the `/login` page so it only detects auth after the actual sign-in redirect\n- Fixed \"No API key configured\" showing after signing out — now correctly shows \"Not signed in\" with a prompt to sign in\n- Added `/api/organizations` as a final fallback for org ID resolution when the bootstrap API response doesn't include it\n- Fixed usage data not loading after sign-in — API requests now include required browser-like headers (Origin, Referer, User-Agent) that Claude's usage endpoints require"
 }