Use it now
Useful2 Signal2
Federation tokens are cached on disk, and you can move the cache with a new env var.
What's wrong with this entry?
Anonymous. No account, no email.
CLAUDE_CODE_FEDERATION_CACHE_DIR
What
Setups that federate to Anthropic through an OIDC identity token now cache the resulting federation token on disk, so a token is not re-fetched every time. The directory is created mode 0700 and the location can be pointed elsewhere with the new environment variable CLAUDE_CODE_FEDERATION_CACHE_DIR.
Details
- The cache file name is derived from a hash of the federation rule id, org, workspace, service account, scope, base URL and the identity token, so a change in any of those uses a different file.
- Caching is refused, with the reason logged and the session continuing uncached, if the directory is group- or other-accessible, is owned by a different user, if no identity token can be read, or if there is no config directory.
- Only applies when the auth type is OIDC federation and the environment-variable configuration path is in use.
Evidence
CLAUDE_CODE_FEDERATION_CACHE_DIR
Strings lifted out of the shipped bundle, so the claim above can be checked against them.