{"name":"CLAUDE_CODE_OAUTH_TOKEN","slug":"claude-code-oauth-token","family":"env","title":"Environment variables","noun":"environment variable","description":"Three artifact environment variables are now recognised, with the API token stripped from spawned processes as a secret.","description_source":"entry","described_by":{"version":"2.1.221","anchor":"artifact-environment-variables-with-the-api-token-treated-as"},"presence":{"first_seen":"2.1.138","removed_in":null,"in_current_build":true,"newest_mined":"2.1.308","builds":149,"mined_builds":149,"first_cited":{"version":"2.1.225","released_at":"2026-08-07 23:08:56","spans":9}},"aliases":[],"entries":[{"version":"2.1.307","anchor":"claim-rejects-claude-code-oauth-token-in-launcher-started-pr","heading":"Spare SDK processes started by a launcher refuse a sign-in token passed at claim time","line":"A pre-warmed Claude Code process started by an organization's launcher now refuses CLAUDE_CODE_OAUTH_TOKEN when claimed, and asks its host instead","released_at":"2026-10-21 20:47:18","reason":"found in this entry's text"},{"version":"2.1.307","anchor":"auth-a-launcher-lent-oauth-token-is-now-honoured-but-not-r","heading":"Claude Code can sign in with a login lent by the desktop app","line":"A sign-in lent by the desktop app now counts like `CLAUDE_CODE_OAUTH_TOKEN`, though plugins cannot use it","released_at":"2026-10-21 20:47:18","reason":"named in this entry, found in this entry's text"},{"version":"2.1.307","anchor":"host-managed-auth-no-longer-overrides-an-explicit-oauth-toke","heading":"An OAuth token now wins over host-managed mode","line":"With `CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST` set, Claude Code now uses a supplied OAuth token instead of the host's sign-in","released_at":"2026-10-21 20:47:18","reason":"named in this entry, found in this entry's text"},{"version":"2.1.307","anchor":"org-pin-check-accepts-a-desktop-app-provided-sign-in","heading":"Organization sign-in rules now cover sign-ins from the desktop app","line":"When `forceLoginOrgUUID` pins an organization, Claude Code now also checks a sign-in provided by the desktop app","released_at":"2026-10-21 20:47:18","reason":"found in this entry's text"},{"version":"2.1.307","anchor":"update-environment-variables-routes-claude-code-oauth-token","heading":"A remote host's new sign-in token may be held back instead of applied","line":"When a remote connection sends a new CLAUDE_CODE_OAUTH_TOKEN, Claude Code can now pass it to a separate check rather than switching to it","released_at":"2026-10-21 20:47:18","reason":"named in this entry, found in this entry's text"},{"version":"2.1.307","anchor":"org-credential-change-warning-also-triggers-on-managed-auth","heading":"Organisation change check now also covers host-managed sign-in","line":"Claude Code now uses CLAUDE_CODE_ORGANIZATION_UUID to spot an organisation change when sign-in is managed for it","released_at":"2026-10-21 20:47:18","reason":"named in this entry, found in this entry's text"},{"version":"2.1.301","anchor":"claude-code-oauth-token-read-through-a-wrapper-in-refresh-to","heading":"CLAUDE_CODE_OAUTH_TOKEN is now read through a helper in the token refresh check","line":"The token-refresh check now reads CLAUDE_CODE_OAUTH_TOKEN through a helper instead of directly from the environment","released_at":"2026-10-15 14:34:23","reason":"found in this entry's text, named in this entry"},{"version":"2.1.300","anchor":"new-credential-road-telemetry-and-cloud-launch-credential-ev","heading":"Analytics now note where your sign-in credential came from","line":"Some analytics events now record how the credential was supplied, such as an environment variable, a file descriptor or none at all","released_at":"2026-10-14 14:27:26","reason":"found in this entry's text"},{"version":"2.1.295","anchor":"first-party-event-logging-gains-tenant-send-rules-and-git","heading":"Usage data now records whether your git working copy was clean at start","line":"Usage data now notes whether your git working copy had changes when the session started, and some usage data can be held back from sending","released_at":"2026-10-08 18:22:58","reason":"found in this entry's text"},{"version":"2.1.290","anchor":"existing-sign-in-detection-helper","heading":"Claude Code can detect an existing sign-in from token variables","line":"A new check finds out whether a usable sign-in already exists, for example from `CLAUDE_CODE_OAUTH_TOKEN`","released_at":"2026-10-05 18:12:44","reason":"found in this entry's text"}],"entries_total":34,"docs":[{"source":"claude-code","path":"agent-sdk\/claude-code-features","title":"Use Claude Code features in the SDK","documented":false},{"source":"claude-code","path":"agent-sdk\/typescript","title":"Agent SDK reference - TypeScript","documented":false},{"source":"claude-code","path":"authentication","title":"Authentication","documented":false},{"source":"claude-code","path":"devcontainer","title":"Development containers","documented":false},{"source":"claude-code","path":"errors","title":"Error reference","documented":false},{"source":"claude-code","path":"github-actions","title":"Claude Code GitHub Actions","documented":false},{"source":"claude-code","path":"hooks-guide","title":"Automate actions with hooks","documented":false},{"source":"claude-code","path":"llm-gateway-connect","title":"Connect Claude Code to an LLM gateway","documented":false},{"source":"claude-code","path":"mcp","title":"Connect Claude Code to tools via MCP","documented":false},{"source":"claude-code","path":"permissions","title":"Configure permissions","documented":false}],"docs_total":12,"gates":[],"related":[{"name":"CLAUDE_CODE_OAUTH_401_WAIT_MS","slug":"claude-code-oauth-401-wait-ms","description":"Milliseconds Claude Code waits for a rotated token after an API call returns 401 while its OAuth token comes from `CLAUDE_CODE_OAUTH_TOKEN` or the OAuth token file descriptor source; `0` skips the wait. Default `60000` when `CLAUDE_CODE_REMOTE_SESSION_ID` is set and `0` otherwise; minimum `0`."},{"name":"CLAUDE_CODE_OAUTH_CLIENT_ID","slug":"claude-code-oauth-client-id","description":"Overrides the OAuth client ID in Claude Code's OAuth configuration, and is passed as the client ID when logging in from `CLAUDE_CODE_OAUTH_REFRESH_TOKEN`. An empty value is ignored."},{"name":"CLAUDE_CODE_OAUTH_REFRESH_TOKEN","slug":"claude-code-oauth-refresh-token","description":"OAuth refresh token for Claude.ai authentication. When set, `claude auth login` exchanges this token directly instead of opening a browser. Requires `CLAUDE_CODE_OAUTH_SCOPES`. Useful for provisioning authentication in automated environments"},{"name":"CLAUDE_CODE_OAUTH_SCOPES","slug":"claude-code-oauth-scopes","description":"CLAUDE_CODE_OAUTH_SCOPES no longer defaults to 'user:inference' when unset"},{"name":"CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR","slug":"claude-code-oauth-token-file-descriptor","description":"Login tokens are warmed at startup, and skipped entirely for token-based auth."}],"url":"https:\/\/changelogs.core-directive.com\/reference\/env\/claude-code-oauth-token","family_url":"https:\/\/changelogs.core-directive.com\/reference\/env.json"}