What
Setups that federate to Anthropic through an OIDC identity token now cache the resulting federation token on disk, so a token is not re-fetched every time. The directory is created mode 0700 and the location can be pointed elsewhere with the new environment variable CLAUDE_CODE_FEDERATION_CACHE_DIR.
Details
- The cache file name is derived from a hash of the federation rule id, org, workspace, service account, scope, base URL and the identity token, so a change in any of those uses a different file.
- Caching is refused, with the reason logged and the session continuing uncached, if the directory is group- or other-accessible, is owned by a different user, if no identity token can be read, or if there is no config directory.
- Only applies when the auth type is OIDC federation and the environment-variable configuration path is in use.
Evidence
CLAUDE_CODE_FEDERATION_CACHE_DIR
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundleCLAUDE_CODE_FEDERATION_CACHE_DIR
One source agreesOne thing we can check says the same as this entry.
The name it cites is new in this build
New in this build: CLAUDE_CODE_FEDERATION_CACHE_DIR