When you run claude for the first time, you'll be prompted to authenticate. You have options. The first is an Anthropic API key, which you paste directly into the terminal. The second is OAuth via your browser, which opens a login page and stores a token automatically.
Your credentials are stored locally on your machine. Claude Code never sends them anywhere except Anthropic's API endpoints. I want to flag one thing: if auth fails mid-session, you'll see a clear error and a prompt to re-authenticate. You won't lose your session history. Just re-run the auth flow and continue.