(scrap-ingest-seat)=
# Ingest on a Claude seat instead of an API key

By the end of this page scrap reads your photos, and tags and summarises your notes, through
your Claude seat rather than an API key. It is a change to an install you already have, not an
install of its own: do one of [](install-lan.md), [](install-server.md) or
[](install-kubernetes.md) first.

```{important}
**An API key is the encouraged default.** Use this page only if you have a Claude seat (Team or
Enterprise) and no Claude Console account to make a key in. scrap runs the Claude
Code CLI (`claude -p`) with a long-lived token from `claude setup-token`
([ADR 0021](../explanations/decisions/0021-ingest-on-a-claude-seat-through-claude-p.md)). Use
your own seat only. Whether your plan or organisation lets a seat be used for unattended work
is its own policy: check it with your Claude admin first. These docs cannot promise it is
allowed.
```

The token is a credential for your **whole seat**, with no spend cap, until it expires or you
revoke it. Calls count against your seat's usage limits, shared with your own use of Claude;
when a limit is hit, ingest pauses until it resets. Every Claude call in scrap takes this
route, photos and text enrichment alike.

```{warning}
A published `-claude` image is planned. Until then, **you build it yourself**: the next section
does it, from the release image you already run.
```

## Build the image with the Claude CLI

`Dockerfile.claude` adds only the CLI's native binary (pinned, and checked against its SHA-256)
on top of a scrap image. It is from the release you run, so fetch it in an empty folder:

```
mkdir -p ~/scrap-claude-build && cd ~/scrap-claude-build
curl -fsSL -o Dockerfile.claude \
    https://raw.githubusercontent.com/gilesknap/scrap/{{ release_tag }}/Dockerfile.claude
podman build -f Dockerfile.claude --build-arg BASE=ghcr.io/gilesknap/scrap:{{ release_tag }} \
    -t localhost/scrap-claude:{{ release_tag }} .
podman run --rm --entrypoint claude localhost/scrap-claude:{{ release_tag }} --version
```

The last command should print a Claude Code version. The image is about 240 MB larger than
scrap's. Build it again, with the new release as `BASE`, each time you update scrap.

On Kubernetes, build the same way, then tag the image for your own registry, push it, and set
`image.repository` and `image.tag` in your values to it.

## Get the token

On any machine where Claude Code is logged in to your seat, run:

```
claude setup-token
```

Copy only the token it prints: one line starting `sk-ant-oat01-`, not the line after it. Keep
it out of shell history, notes and anything you commit.

## Give scrap the token

Use the one section for your install.

### Container on a LAN, or single server

`SCRAP_LLM_BACKEND` is `api` (the default) or `cli`. Set it with the token and drop
`ANTHROPIC_API_KEY`:

- LAN: read the token into your shell the way the README reads the key, then remove the container
  and run it again with the new image (the volume keeps your data):

  ```
  printf 'Claude token: '; read -rs CLAUDE_CODE_OAUTH_TOKEN; export CLAUDE_CODE_OAUTH_TOKEN
  podman rm -f scrap   # only if you started it with --name scrap
  podman run -d --name scrap --restart unless-stopped --network=host -v scrap-data:/data \
      -e SCRAP_INGEST=on -e SCRAP_LLM_BACKEND=cli -e CLAUDE_CODE_OAUTH_TOKEN \
      localhost/scrap-claude:{{ release_tag }} serve
  ```

  Add `--host 0.0.0.0`, `TZ` and `SCRAP_PUBLIC_URL` from [](install-lan.md) if you used them.
- Server: in `~/.config/scrap/ingest.env` (mode 600) set:

  ```
  SCRAP_INGEST=on
  SCRAP_LLM_BACKEND=cli
  CLAUDE_CODE_OAUTH_TOKEN=<your token>
  ```

  Set `SCRAP_IMAGE=localhost/scrap-claude:{{ release_tag }}` in `~/.config/scrap/env` and re-run
  `./deploy/install.sh`. The CLI takes about 250 MB while it runs, so raise `SCRAP_MEMORY_MAX`
  there too, for example to `1.5g`.

`podman inspect scrap` shows the container's environment, token included: do not paste it
anywhere.

### Kubernetes

The chart has no first-class option for the token, so pass it through `extraEnv`. The chart still
reads `ANTHROPIC_API_KEY` from `ingest.existingSecret` whenever ingest is on, so put an empty
one in the same Secret:

```
read -rs TOKEN && printf %s "$TOKEN" | kubectl -n scrap create secret generic scrap-claude \
    --from-literal=ANTHROPIC_API_KEY= --from-file=CLAUDE_CODE_OAUTH_TOKEN=/dev/stdin; unset TOKEN
```

The token goes in on standard input, so it is not on `kubectl`'s command line.

If your registry needs credentials, create an image pull Secret and list it under
`imagePullSecrets` in the values. Add to your values, with your own image from the build section:

```yaml
image:
  repository: registry.example.com/me/scrap-claude
  tag: {{ release_tag }}
ingest:
  enabled: true
  existingSecret: scrap-claude
extraEnv:
  - name: SCRAP_LLM_BACKEND
    value: cli
  - name: CLAUDE_CODE_OAUTH_TOKEN
    valueFrom:
      secretKeyRef:
        name: scrap-claude
        key: CLAUDE_CODE_OAUTH_TOKEN
```

Then upgrade with the new values:

```
helm upgrade scrap oci://ghcr.io/gilesknap/charts/scrap --version {{ chart_version }} \
    -n scrap -f my-values.yaml
```

The nightly related-pages and weekly topics CronJobs get the same environment. Raise
`resources.limits.memory` if the pod is killed: the CLI takes about 250 MB.

## Check a photo is read

Capture a photo in the app. Within about a minute its page shows a kind, a description and tags
instead of waiting. If it does not, read scrap's log (`podman logs scrap`, `journalctl` or
`kubectl logs` as in your install). Without the token or the `claude` binary, ingest pauses with
reason `auth` until you press **Resume**, and the log says which is missing. Nothing is lost while
it is paused. A `401 ... invalid` means the token was copied wrongly: fix it, restart scrap, then
**Resume**.

`SCRAP_BUDGET_DAY_USD` still applies, to what the calls would cost at API prices, not to
anything you are charged. Set `SCRAP_ENRICH=off` to keep the seat to photos.