{"version":"2.1.236","anchor":"sdk-hosts-can-decline-an-oauth-token-refresh-and-say-why","canonical_anchor":"sdk-hosts-can-decline-an-oauth-token-refresh-and-say-why","heading":"SDK hosts can decline an OAuth token refresh and say why","tier":"internal","area":"SDK","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.236\/e\/sdk-hosts-can-decline-an-oauth-token-refresh-and-say-why","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.236","markdown":"### SDK hosts can decline an OAuth token refresh and say why\n\nAn SDK host can now refuse to refresh your login token and say why.\n\n**What**\n\nWhen Claude Code asks its SDK host to refresh an OAuth token, the host may now answer with no token plus an optional reason, and the client treats that as a clean decline rather than an assumed success.\n\n**Details**\n\n- The refresh path returns null when the host declines or answers empty, and records the host's stated reason.\n- A new `tengu_sdk_oauth_refresh_unfulfilled` event distinguishes stream_closed, timeout, invalid_response, declined and null outcomes, with a duration.\n- The reason field is parsed leniently, so an unknown or malformed value becomes undefined and can never cost a token that was actually delivered.\n- SDK transport only.\n\n**Evidence**\n\n`tengu_sdk_oauth_refresh_unfulfilled`, `Why the host returned no token (only meaningful when accessToken is null)`\n\n- Area: SDK\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 2\/5"}