Claude Code release notes: 2.1.238 authenticates private plugin marketplaces

Claude Code 2.1.238 can fetch a private plugin marketplace with HTTP headers minted when they are needed. The feature is called headersHelper. It gives teams an alternative to putting a static credential in the marketplace URL.

Claude Code 2.1.238 adds headersHelper for plugin marketplaces

A plugin marketplace is a catalog where a team distributes Claude Code plugins for shared installation and updates. From version 2.1.238, a URL marketplace or an individual catalog entry can specify headersHelper.

The helper runs a command that mints HTTP headers, such as a short-lived token. Claude Code uses those headers to fetch the catalog and plugin archives hosted on the same origin.

Source: Claude Code v2.1.238 release notes.

How installation and updates work

When headersHelper is attached to a catalog entry, it runs only when the user installs or updates that plugin. Claude Code shows the command before it runs and asks [y/N]. For an intentional non-interactive installation, an administrator can pass -y.

The team does not need to put a long-lived token in the marketplace URL. Its existing authentication service can mint a fresh header at fetch time, while Claude Code handles the catalog and archive request. Use a scoped account and log which plugin versions were installed.

Human step: Update Claude Code to 2.1.238 or later. Have the marketplace maintainer configure headersHelper, then run the installation or update and review the command Claude Code displays.

Source: Anthropic's plugin marketplace documentation.

Availability and limits

The feature arrived in 2.1.238. It applies to URL marketplaces and catalog entries, and archive headers apply to same-origin fetches. The public notes for versions 2.1.240 and 2.1.241 list only bug fixes and reliability improvements, so 2.1.238 remains the latest documented feature change for this mechanism.

Sources: Claude Code v2.1.241. Current Claude Code version in the npm registry.