{"version":"2.1.167","anchor":"auth-validation-bypass-for-host-managed-providers","canonical_anchor":"auth-validation-bypass-for-host-managed-providers","heading":"Auth validation bypass for host-managed providers","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.167\/e\/auth-validation-bypass-for-host-managed-providers","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.167","markdown":"### Auth validation bypass for host-managed providers\n\nWhen Claude Code is running inside a host environment that manages its own authentication (i.e., `CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST` is set), the auth validation function now returns `{ valid: true }` immediately instead of evaluating force-login org UUID or force-login method pin restrictions. Previously this path was absent; pin-based restrictions would still be evaluated even under full host management, which could produce spurious validation failures.\n\nA telemetry event (`auth_force_login_org` with value `managed_by_host_under_pin`) is emitted if a force-login policy is configured, so operators can detect and clean up stale policies.\n\n**Evidence**\n\nearly-return added to the auth validation function (search for `\"managed_by_host_under_pin\"`)"}