Summary

The Anthropic/Claude.ai OAuth client ID is stored as a Base64-encoded string rather than a plain constant. This creates a false impression that the value is sensitive when it is not — OAuth client IDs are public by design.

Location

src/llm/utils/oauth/anthropic.ts:46-47

const decode = (s: string) => atob(s);
const CLIENT_ID = decode("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
// Decodes to: 9d1c250a-e61b-44d9-88ed-5944d1962f5e

Problem

• atob() is not encryption — the value is trivially decoded by anyone reading the source
• The obfuscation pattern implies the value is sensitive, which may lead future maintainers to treat it as a secret (e.g. rotating it unnecessarily, or adding it to secret scanning rules)
• The OAuth client ID is sent in cleartext to https://claude.ai/oauth/authorize on every auth flow — it is already public
• This adds unnecessary indirection and a runtime dependency on atob which is not available in all environments

Reproduction

node -e "console.log(atob('OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl'))"
# => 9d1c250a-e61b-44d9-88ed-5944d1962f5e

Fix

Replace with a plain string constant:

// Public OAuth client ID registered with claude.ai — not a secret.
const CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";

Remove the decode helper function entirely.

Reported via automated codebase security review — github.com/openclaw/openclaw