Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.225 Home All releases ←olderv2.1.224 v2.1.226newer→
Claude Code v2.1.225

OAuth 401 recovery no longer silently replaces a user-supplied token

Use it now
Useful4 Signal0
Auth Notable

Your explicitly set OAuth token is no longer silently swapped for a stored credential after a 401.

CLAUDE_CODE_OAUTH_TOKENCLAUDE_CODE_PROVIDER_MANAGED_BY_HOST
What

A 401 no longer causes Claude Code to swap in a credential from disk when you explicitly supplied CLAUDE_CODE_OAUTH_TOKEN.

Details
  • When the token came from the user's environment, and this is not a remote child session or a unix-socket setup, an explicit error is logged and the supplied token is kept
  • The disk-recovery path now additionally requires the stored credential to be unexpired
  • The whole env/disk recovery block is skipped when credentials are host-managed via CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST
  • The recovery failure reason gained a third value for the skipped-user-env-token case, alongside background-worker and interactive no-refresh-token
Evidence

OAuth 401: keeping the user-supplied CLAUDE_CODE_OAUTH_TOKEN instead of adopting the stored credential., oauth_401_skipped_user_env_token

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Related

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.

See this entry in the whole of v2.1.225 →