Follow Discord
Sweep 22 Oct 2026 · 04:32Z Build v2.1.308 527 read Stable v2.1.308 Latest v2.1.308 Next v2.1.308 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeReleasesv2.1.225entry #9

Claude Code v2.1.225 ·

OAuth 401 recovery no longer silently replaces a user-supplied token

Your explicitly set OAuth token is no longer silently swapped for a stored credential after a 401.

Use it now Notable Improvements
JSON All of v2.1.225
Use it nowTier: how much it should matter to you
4Useful: my rating, 1 to 5
0Signal: worth watching, 1 to 5
AuthArea: what it touches
ImprovementsKind: in v2.1.225,
What probably matters to youSection of the release
What

A 401 no longer causes Claude Code to swap in a credential from disk when you explicitly supplied CLAUDE_CODE_OAUTH_TOKEN.

Details
  • When the token came from the user's environment, and this is not a remote child session or a unix-socket setup, an explicit error is logged and the supplied token is kept
  • The disk-recovery path now additionally requires the stored credential to be unexpired
  • The whole env/disk recovery block is skipped when credentials are host-managed via CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST
  • The recovery failure reason gained a third value for the skipped-user-env-token case, alongside background-worker and interactive no-refresh-token
Evidence

OAuth 401: keeping the user-supplied CLAUDE_CODE_OAUTH_TOKEN instead of adopting the stored credential., oauth_401_skipped_user_env_token

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Read from
Names in the bundleCLAUDE_CODE_OAUTH_TOKENCLAUDE_CODE_PROVIDER_MANAGED_BY_HOST
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeFixed a transient 401 replacing a long-lived CLAUDE_CODE_OAUTH_TOKEN with a stored login's short-lived token, breaking headless sessions…

See this entry in the whole of v2.1.225 →

Feedback