Follow Discord
Sweep 22 Oct 2026 · 04:32Z Build v2.1.308 527 read Stable v2.1.308 Latest v2.1.308 Next v2.1.308 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeReleasesv2.1.224entry #97

Claude Code v2.1.224 ·

self-hosted-runner decode-token inspects a session token, verifying it by default

decode-token prints a session token's claims, verifying signature and expiry by default.

Use it now Notable New Features
JSON All of v2.1.224
Use it nowTier: how much it should matter to you
2Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
Self-Hosted RunnerArea: what it touches
New FeaturesKind: in v2.1.224,
What probably matters to youSection of the release
What

Decodes a session access token and prints its claims, reading it from an argument, from $CLAUDE_CODE_SESSION_ACCESS_TOKEN, or from stdin up to 16 KiB. Signature verification against the published key set and the expiry/not-before check with 60 seconds of clock skew are both on by default.

Details
  • --no-verify skips the signature check, --no-check-expiry skips the time check, --header prints the token header instead of the claims.
  • --verify still parses but does nothing, kept so older wrapper scripts do not break.
  • Only ES256 and RS256 signatures are accepted.
Usage
claude self-hosted-runner decode-token --header
Evidence

decode-token: signature verification FAILED

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Read from
Names in the bundleself-hosted-runner decode-tokenCLAUDE_CODE_SESSION_ACCESS_TOKEN--header--no-check-expiry--no-verify
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeAdded self-hosted environments: claude self-hosted-runner turns your own machines or containers into a place Claude Code web, mobile, and…

See this entry in the whole of v2.1.224 →

Feedback