Assrt token: which token Assrt uses, where it lives on disk, in what order it resolves

Token 1: the Anthropic credential

This is the credential the LLM agent uses to call the Anthropic API. Without it, no model call goes out and no test runs. The resolution function is small enough to read in full:

// assrt-mcp/src/core/keychain.ts
const KEYCHAIN_SERVICE = "Claude Code-credentials";

export function getCredential(): AuthCredential {
  // 1. Explicit env var, works on any platform
  const envKey = process.env.ANTHROPIC_API_KEY;
  if (envKey) {
    console.error("[auth] Using ANTHROPIC_API_KEY env var");
    return { token: envKey, type: "apiKey" };
  }

  if (process.platform !== "darwin") {
    throw new Error(
      "No credentials found. Set ANTHROPIC_API_KEY, " +
      "or run on macOS with Claude Code installed."
    );
  }

  // 2. macOS Keychain (zero-setup if Claude Code is logged in)
  try {
    const raw = execSync(
      `security find-generic-password -s "${KEYCHAIN_SERVICE}" -w`,
      { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] }
    ).trim();
    const parsed: ClaudeCredentials = JSON.parse(raw);
    const token = parsed?.claudeAiOauth?.accessToken;
    if (token) {
      console.error("[auth] Using Claude Code OAuth token from macOS Keychain");
      return { token, type: "oauth" };
    }
  } catch { /* keychain entry not found */ }

  throw new Error("No credentials found. ...");
}

Two sources, checked in order. The env var wins because it is portable and explicit; the keychain wins on macOS dev machines because it requires zero setup if Claude Code is already installed. The branch at line 40 is the seam: on Linux or Windows with no env var, the function throws immediately and tells the user what to do, instead of silently hanging on a shell command that does not exist.

Token 2: the Playwright extension token

The second token is optional. You only encounter it if you opt into extension mode, which tells Assrt to attach to your already-running Chrome instead of launching a fresh browser. That mode is useful for testing flows behind authentication without re-logging in every run. The token is what the Playwright MCP Chrome extension issues to authorize the bridge.

The relevant constants and resolution function:

// assrt-mcp/src/core/browser.ts
private static readonly EXTENSION_TOKEN_PATH = ".assrt/extension-token";

private async resolveExtensionToken(tokenParam?: string): Promise<string | null> {
  const tokenPath = join(homedir(), McpBrowserManager.EXTENSION_TOKEN_PATH);

  // 1. Explicit parameter (highest priority); also persisted for next time
  if (tokenParam) {
    mkdirSync(join(homedir(), ".assrt"), { recursive: true });
    writeFileSync(tokenPath, tokenParam.trim());
    console.error("[browser] extension token saved to ~/.assrt/extension-token");
    return tokenParam.trim();
  }

  // 2. Environment variable
  const envToken = process.env.PLAYWRIGHT_MCP_EXTENSION_TOKEN;
  if (envToken) return envToken.trim();

  // 3. Saved file
  try {
    const saved = readFileSync(tokenPath, "utf-8").trim();
    if (saved) return saved;
  } catch { /* file does not exist */ }

  return null;
}

Note the side-effect on the parameter branch: pass an explicit token once, and Assrt writes it to ~/.assrt/extension-token for you. From the next run on, the saved-file branch resolves it without you doing anything. This is the setup-once behavior the README promises.

What “assrt token” does not mean

Worth being explicit about a few things this term does not refer to, because the topic gets muddled.

• Not a cryptocurrency. There is no Assrt token on any chain, no airdrop, no presale, no contract address. Assrt is an open-source test automation framework; the only thing it issues is npm packages and CLI output.
• Not a workspace API key issued by Assrt. Comparable test SaaS products (the ones that cost five figures a month) issue their own API keys. Assrt does not. There is no dashboard at assrt.ai that mints credentials. The web app at app.assrt.ai is a viewer for runs, not an issuer of keys.
• Not an Anthropic-issued OAuth token Assrt creates. The OAuth token in the keychain is created by Claude Code when you log in there. Assrt only reads it. If you have never used Claude Code on this machine, that path resolves to nothing and you fall back to ANTHROPIC_API_KEY.
• Not a Playwright session cookie. The extension token is an approval token for the Chrome bridge, not a session credential for any site under test. Cookies and localStorage for the sites you test live in ~/.assrt/browser-profile (the persistent profile) or in your real Chrome user-data-dir (extension mode), separately from the bridge token.

How both tokens flow into a single test run

For a normal headless run, only the Anthropic credential matters. For an extension-mode run, both are read and consumed at different layers. The agent never touches the extension token, and the browser layer never sees the Anthropic credential. The two paths converge only at the run-start log line.

One call site for each token, one consumption site. The credential is constructor-injected into TestAgent at agent.ts:342 and never written to disk by Assrt. The extension token is passed through to the Playwright MCP child process and never sent to Anthropic. Crossing the two would be a bug, and the type system makes it hard to do by accident: AuthCredential and the extension token are different types in different files.