self-hosted-runner decode-token inspects a session token, verifying it by default / Claude Code v2.1.224

Use it now

Useful2 Signal3

Self-Hosted Runner Notable

decode-token prints a session token's claims, verifying signature and expiry by default.

self-hosted-runner decode-tokenCLAUDE_CODE_SESSION_ACCESS_TOKEN--header--no-check-expiry--no-verify

What

Decodes a session access token and prints its claims, reading it from an argument, from $CLAUDE_CODE_SESSION_ACCESS_TOKEN, or from stdin up to 16 KiB. Signature verification against the published key set and the expiry/not-before check with 60 seconds of clock skew are both on by default.

Details

--no-verify skips the signature check, --no-check-expiry skips the time check, --header prints the token header instead of the claims.
--verify still parses but does nothing, kept so older wrapper scripts do not break.
Only ES256 and RS256 signatures are accepted.

Usage

claude self-hosted-runner decode-token --header

Evidence

decode-token: signature verification FAILED

Strings lifted out of the shipped bundle, so the claim above can be checked against them.