Does a CI pipeline that calls verboo fail on authentication even after you set a key? Up to Verboo Code v0.15.17, that was the expected behavior: the CLI's startup auth gate only recognized an OAuth session, so a perfectly valid vbk_ API key sat unused in any environment without an interactive terminal. Fixed in v0.15.18. Here is the exact command to set this up today, everything verified straight from the verbeux-ai/code source.
Why does the normal Verboo Code login fail inside a CI runner?
Because it depends on opening a browser. When you run verboo on a machine with an interactive terminal, the CLI detects the missing session and opens code.verboo.ai automatically to complete OAuth. A GitHub Actions runner, a GitLab CI runner, or any ephemeral container has neither an interactive terminal nor a browser, so that flow could never complete.
The source itself documents the decision in a comment: "Verboo auth gate. In a TTY it opens the browser automatically; headless it throws a clear error" (src/main.tsx, translated from the original Portuguese comment).
Which environment variable does Verboo Code read to authenticate without a browser?
ANTHROPIC_API_KEY. Not VERBOO_API_KEY, the name the Router docs suggest for direct HTTP calls: it is the same variable the rest of the Claude Code ecosystem uses for an API key, and it is the one the Verboo Code startup gate reads first. If the value starts with the vbk_ prefix, the CLI treats it as a valid headless session:
export ANTHROPIC_API_KEY="your_vbk_key_here"
verboo -p "run the test suite and fix whatever fails" --output-format jsonThe key is not validated against /api/me, which rejects API keys. It is validated with Authorization: Bearer straight against the router endpoint, code.verboo.ai/router/v1/models. That endpoint choice is documented in the code review that introduced the feature (PR #43 in the verbeux-ai/code repository): the team only switched endpoints after confirming the first one did not accept this kind of key.
Where do I create a vbk_ key?
On the dashboard at code.verboo.ai, the "Create API key" button in the top right corner, which leads to the key management page. Each key is tied to a model group, so pick the same group you already use day to day before pasting the value into your CI secret.
Can I keep an OAuth session, without a fixed key, and without opening a browser on the server?
Yes. verboo auth login --headless runs the full OAuth flow without depending on a browser on that machine: the CLI prints a URL, you open it on any other device, confirm the login, and paste the authorization code back into the server's terminal. It is the option the team itself describes as "ideal for servers/CI", but with one important difference from the API key: there is still a human in the loop, once, so it fits a persistent server or self-hosted runner better than an ephemeral runner that is born and dies on every run.
| Path | Human in the loop | Best for |
|---|---|---|
ANTHROPIC_API_KEY=vbk_... | No, not once | Ephemeral runner (GitHub Actions, GitLab CI) |
verboo auth login --headless | Yes, once, on another device | Persistent server or self-hosted runner |
verbeux-ai/code, PR #43.What shows up when the key is wrong or expired?
A specific message, not a generic login prompt: "API key inválida ou expirada" (invalid or expired API key). If there is no vbk_ key and no OAuth session in a terminal without a TTY, the message changes to "Não autenticado no Verboo. Execute verboo /login em um terminal interativo antes de usar o modo headless." (not authenticated with Verboo; run verboo /login in an interactive terminal before using headless mode). Both strings are written exactly like that in the source (verbooStartupAuth.ts), with a unit test guaranteeing one never turns into the other.
Does API key authentication skip any check I should know about?
Yes, and it is intentional. The terms-of-service acceptance flow and the entitlement check (which confirms your subscription is active) both depend on endpoints that only accept OAuth. On the API key path, Verboo Code skips both and goes straight to the session. That is safe for the common case, but if your pipeline needs to block execution when terms change or a subscription lapses, that will not happen automatically with the key alone.
A CI pipeline runs the same task dozens of times a day, with nobody watching the terminal. On Verboo Code, every one of those calls uses open models with unlimited tokens, so re-running after a failed test is never a budget decision.
