Why a Signature Check Can't Tell Official From Subscription-Reversed

Part of our "Why So Cheap?" series. The first piece explained why subscription-reversed access is cheap; the second explained why it's unstable. This one is about a narrower, technical question we get asked often: if a cryptographic signature check passes, doesn't that prove the key is legitimate? The honest answer is that it proves something real — just not that.

What the signature actually verifies

When Claude's extended thinking is enabled, the API returns a signature field alongside the model's reasoning. Anthropic's own documentation describes this as a token the API checks to confirm the thinking content wasn't modified and to link it "to the specific request and response" (Claude Platform docs, "Thinking"). In plain terms: a valid signature is Anthropic's own backend vouching that the reasoning it returned really came from Claude, for that exact exchange. It is a claim about the model. It is not a claim about which API key, account, or billing arrangement was used to reach that model.

Why an OAuth-based subscription proxy can still pass

A genuine metered API key is one thing: a credential issued through Anthropic's own Console, sent as an Authorization or legacy x-api-key header, tied to billing on that account (Claude API overview docs). A subscription's OAuth token is a different credential, issued for the Claude Code client and claude.ai — and the reverse-engineering tools we described in the economics piece, projects like Wei-Shaw/sub2api, work by taking that OAuth token and speaking the official client's own protocol to Anthropic's real backend. That's a meaningfully different mechanism from a pure web-scraping front end or a fabricated protocol layer: the request actually lands on Anthropic's model-serving infrastructure, using real credentials Anthropic itself issued — just not for this use. Anthropic's real backend produces a real signature in response, because as far as the backend is concerned, it served a real request. This is precisely the use Anthropic has been closing off since 2026-01-09, in the enforcement steps we sourced and dated in the previous piece (timeline) — but none of those steps change what the signature check itself can see: it has no field for "which credential type authenticated this request," only for "did Claude produce this thinking."

What a signature check is genuinely good for

It rules out the cruder failure modes cleanly: a pure web-reverse-proxy that never touches Anthropic's servers, a fabricated response format dressed up to look like Claude's, or a request billed as one model but silently served by another and stamped with a forged-looking signature block. None of those can produce a signature that Anthropic's backend itself would validate. That's a real and useful filter — it just answers a narrower question than "is this official supply" implies.

Our own verifier has the same boundary

The same limit applies to the tool on this site. Our browser-based verifier runs four checks — reachability and auth, model identity, response fingerprint, and latency — as described in our methodology. Those checks are built to answer "is this really talking to the genuine model," and a pass is evidence of exactly that: the model behaved like the one it claims to be, on the date you ran the test. None of the four checks, individually or together, can determine whether that genuine model access is routed through an official metered key or a subscription-reversed one — both produce a model that behaves like Claude, because in the OAuth-reversed case, it is Claude. We say this plainly in our methodology rather than imply our verdicts ("Likely genuine", "Suspicious", "Unreachable / not testable") mean something broader than they do.

So what would actually distinguish them?

Not a single request-response check — a pattern over time. The signals that do carry information are behavioral rather than cryptographic: whether the endpoint shows the rate-limit contention typical of a pooled subscription account under shared load, and whether its uptime history has the jagged, saw-blade shape typical of supply tied to a subscription source (see why reverse-engineered channels die in waves) rather than the flat line typical of a directly metered account. Those require watching a provider over weeks, not one browser check — which is also why we publish reachability history per provider rather than folding it into a single pass/fail verdict.

FAQ

This page describes a general technical limitation of signature-based verification, sourced to Anthropic's own documentation, and states the same limitation about our own verifier. It makes no claim that any specific reseller is or isn't using subscription-reversed access. See our methodology and the rest of the series.