CLAUDE_CODE_OAUTH_TOKEN
A Claude Code environment variable, read out of the shipped bundle. It has been in the build since v2.1.138, including the newest one read.
Three artifact environment variables are now recognised, with the API token stripped from spawned processes as a secret.
Not Anthropic's. This is the line from the earliest changelog entry here that named it, v2.1.221.
In the changelogs
34Releases whose published page names CLAUDE_CODE_OAUTH_TOKEN.
-
v2.1.307
Spare SDK processes started by a launcher refuse a sign-in token passed at claim time
A pre-warmed Claude Code process started by an organization's launcher now refuses CLAUDE_CODE_OAUTH_TOKEN when claimed, and asks its host instead
found in this entry's text
-
v2.1.307
Claude Code can sign in with a login lent by the desktop app
A sign-in lent by the desktop app now counts like
CLAUDE_CODE_OAUTH_TOKEN, though plugins cannot use itnamed in this entry, found in this entry's text
-
v2.1.307
An OAuth token now wins over host-managed mode
With
CLAUDE_CODE_PROVIDER_MANAGED_BY_HOSTset, Claude Code now uses a supplied OAuth token instead of the host's sign-innamed in this entry, found in this entry's text
-
v2.1.307
Organization sign-in rules now cover sign-ins from the desktop app
When
forceLoginOrgUUIDpins an organization, Claude Code now also checks a sign-in provided by the desktop appfound in this entry's text
-
v2.1.307
A remote host's new sign-in token may be held back instead of applied
When a remote connection sends a new CLAUDE_CODE_OAUTH_TOKEN, Claude Code can now pass it to a separate check rather than switching to it
named in this entry, found in this entry's text
-
v2.1.307
Organisation change check now also covers host-managed sign-in
Claude Code now uses CLAUDE_CODE_ORGANIZATION_UUID to spot an organisation change when sign-in is managed for it
named in this entry, found in this entry's text
-
v2.1.301
CLAUDE_CODE_OAUTH_TOKEN is now read through a helper in the token refresh check
The token-refresh check now reads CLAUDE_CODE_OAUTH_TOKEN through a helper instead of directly from the environment
found in this entry's text, named in this entry
-
v2.1.300
Analytics now note where your sign-in credential came from
Some analytics events now record how the credential was supplied, such as an environment variable, a file descriptor or none at all
found in this entry's text
-
v2.1.295
Usage data now records whether your git working copy was clean at start
Usage data now notes whether your git working copy had changes when the session started, and some usage data can be held back from sending
found in this entry's text
-
v2.1.290
Claude Code can detect an existing sign-in from token variables
A new check finds out whether a usable sign-in already exists, for example from
CLAUDE_CODE_OAUTH_TOKENfound in this entry's text
-
v2.1.288
Login now tells you when your sign-in worked but could not be saved
If sign-in succeeds in the browser but your credentials cannot be stored, login now shows a dedicated screen explaining what happened and what to do
found in this entry's text
-
v2.1.285
Detection of sign-in forwarded over SSH now checks for a placeholder
Claude Code recognises SSH-forwarded sign-in when a socket is set and exactly one credential variable holds the value ssh-placeholder
found in this entry's text
-
v2.1.284
Your plan name can now come from your organization's account
Claude Code can show your plan as "Claude" plus the name your organization's account gives, instead of a fixed label
found in this entry's text
-
v2.1.281
Login fails loudly when credentials can't be saved (e.g. locked macOS keychain)
Login now shows an error when your credentials can't be saved, for example because the macOS keychain is locked
found in this entry's text, named in this entry
-
v2.1.281
Background-session child environment: auth and new variables handled explicitly
Background sessions now start from a cleaned environment, with login variables added back and some internal variables left out
found in this entry's text
-
v2.1.271
ANTHROPIC_UNIX_SOCKET auth message now checks for CLAUDE_CODE_OAUTH_TOKEN
Diagnostic message for ANTHROPIC_UNIX_SOCKET now explicitly flags a missing CLAUDE_CODE_OAUTH_TOKEN
found in this entry's text
-
v2.1.271
Grove config check now gated behind an additional OAuth-scope/token check
Grove config check now also requires a specific OAuth scope or a bare CLAUDE_CODE_OAUTH_TOKEN
found in this entry's text
-
v2.1.267
Auth check shortcut for ANTHROPIC_UNIX_SOCKET sessions
Sessions using ANTHROPIC_UNIX_SOCKET now skip most auth checks and rely only on token/key presence
found in this entry's text
-
v2.1.267
Unix-socket sessions determine auth type from OAuth token env var, skipping keychain lookup
Unix-socket sessions now report auth type from the OAuth token env var instead of checking the keychain
found in this entry's text
-
v2.1.257
Simplified cloud/CI environment detection
Detection of external orchestration now checks env var names against allowlists, dropping several individual checks.
found in this entry's text
-
v2.1.251
Subscription and API-key caches can now be cleared explicitly
Logging in or out now clears cached key and subscription state properly.
found in this entry's text
-
v2.1.246
Credentials are primed through the store at start-up
Login tokens are warmed at startup, and skipped entirely for token-based auth.
named in this entry, found in this entry's text
-
v2.1.238
OAuth refresh-token lookup goes async and skips macOS
The stored-refresh-token check now runs asynchronously and returns false straight away on macOS.
found in this entry's text
-
v2.1.234
The CLAUDE_CODE_OAUTH_TOKEN login warning can arrive as its own message
The warning about a set OAuth token env var can now arrive as its own message after login.
named in this entry, found in this entry's text
-
v2.1.229
/login warns if an OAuth token is set in your environment
After logging in, you're warned if an OAuth token in your environment will override it later.
named in this entry, found in this entry's text
-
v2.1.229
OAuth token warning no longer tells you to unset the variable
The OAuth token login warning now correctly says your session switches to the new credentials.
named in this entry, found in this entry's text
-
v2.1.227
Two memory-API environment variables are hidden from commands Claude runs
Your memory API base URL and token are now hidden from every command Claude runs.
found in this entry's text
-
v2.1.225
OAuth 401 recovery no longer silently replaces a user-supplied token
Your explicitly set OAuth token is no longer silently swapped for a stored credential after a 401.
named in this entry, found in this entry's text
-
v2.1.223
Clearer failures when claude.ai project scopes can't be obtained
When project permissions fail, you now get a specific reason and advice instead of a vague error.
named in this entry, found in this entry's text
-
v2.1.223
Settings-supplied API and credential env vars are stripped when ANTHROPIC_UNIX_SOCKET is set
When you connect through a unix socket, settings files can no longer override your API keys or endpoint.
named in this entry, found in this entry's text
-
v2.1.221
Artifact environment variables, with the API token treated as a credential
Three artifact environment variables are now recognised, with the API token stripped from spawned processes as a secret.
found in this entry's text
-
v2.1.221
Artifact credentials and artifact base URLs are stripped from child process environments
Artifact tokens and artifact base URLs no longer leak into processes Claude spawns.
named in this entry, found in this entry's text
-
v2.1.84
Improved Remote Control Error Messages
found in this entry's text
-
v1.0.44
New Features
found in this entry's text
First cited
9The earliest release whose published evidence quoted CLAUDE_CODE_OAUTH_TOKEN was v2.1.225, 7 Aug 2026. That is the oldest release this project wrote about it, so it is a floor on the name's age and not the release that introduced it. It is not a presence reading: which builds carried the name is the table below.
3 further spans in the ledger name it. The list above is the earliest first and stops at 6.
Presence across releases
1Build by build
149One row per release since the first build this name was read out of. Absent means the build was read and the name was not in it, never mined means no bundle for that release was ever archived, and a declared type or a default is only ever what that release's own bundle stated.
Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the environment variable does. All environment variables.