{"version":"2.1.223","anchor":"api-anthropic-com-and-api-staging-anthropic-com-are-accepted","canonical_anchor":"api-anthropic-com-and-api-staging-anthropic-com-are-accepted","heading":"api.anthropic.com and api-staging.anthropic.com are accepted as trusted OAuth origins","tier":"notice","area":"Auth","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.223\/e\/api-anthropic-com-and-api-staging-anthropic-com-are-accepted","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.223","markdown":"### api.anthropic.com and api-staging.anthropic.com are accepted as trusted OAuth origins\n\nLogin now trusts a fixed set of Anthropic API origins unless you point it at a custom OAuth URL.\n\n**What**\n\nOAuth origin validation now trusts a fixed set of Anthropic API origins rather than only the origin derived from the configured base API URL.\n\n**Details**\n\n- If CLAUDE_CODE_CUSTOM_OAUTH_URL is set, only the configured origin is trusted and the fixed set is not consulted.\n- Rejections still report a reason: `not_https`, `userinfo_or_port` or `untrusted_origin`.\n\n**Evidence**\n\n`https:\/\/api-staging.anthropic.com`\n\n- Area: Auth\n- Names: `CLAUDE_CODE_CUSTOM_OAUTH_URL`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 0\/5"}