DEV Community

Jake Reinhold
Jake Reinhold

Posted on

How I gave Claude cookie tools a public no-key JSON API

#devtools #claude #cookie #javascript

If you use Claude Code, you have probably hit this wall: the browser stores your login as a sessionKey cookie, but Claude Code wants ~/.claude/.credentials.json. Two different files, same login.

I built claudecookie.com to bridge the gap. Three tools, one place:

  • Converter — turn Netscape cookies.txt, Cookie-Editor JSON, Puppeteer format, key-value or a raw Cookie header into each other. Runs entirely in your browser; the paste never leaves your device.
  • Check — paste a session cookie and it tells you if the session is alive, which plan it belongs to, and how much of the 5-hour and weekly usage windows is left.
  • Credentials — same check, then download the ~/.claude/.credentials.json Claude Code actually reads.

The public API

Every one of those three exists as a public JSON API. No API key, CORS is *, everything over HTTPS:

# convert
curl https://claudecookie.com/api/v1/convert \
  -H "Content-Type: application/json" \
  -d '{"input":"sessionKey=sk-ant-sid01-...","target":"cookie-editor"}'

# check
curl https://claudecookie.com/api/v1/check \
  -H "Content-Type: application/json" \
  -d '{"cookie":"sessionKey=sk-ant-sid01-..."}'

# credentials
curl https://claudecookie.com/api/v1/credential \
  -H "Content-Type: application/json" \
  -d '{"cookie":"sessionKey=sk-ant-sid01-..."}'
Enter fullscreen mode Exit fullscreen mode

Batch check accepts up to 10 cookies in one request ({"cookies": ["...", "..."]}).

Rate limits (published, no surprises)

Route Budget
All /api/v1/* 10 req/s per IP (burst 20)
POST /convert 60/min per IP
POST /check 20/min per IP
POST /credential 5/min and 20/hour per IP; 3/hour per sessionKey

A 429 response carries a Retry-After header in seconds.

Machine-readable docs

What a check reads

  • account email and plan (Free / Pro / Max)
  • 5-hour usage window and reset time
  • weekly usage window and reset time

It does not log you out, and it does not rotate your cookie on purpose. Treat a live session cookie like a password: only paste a session you control.

The site also has Russian and Chinese versions. Not made by or endorsed by Anthropic.

If you end up using the API, tell me what is missing. The whole point of publishing it with no keys is that agents and scripts can just call it.

Top comments (0)