{"version":"2.1.242","anchor":"oidc-federation-tokens-get-an-on-disk-cache-with-an-env-over","canonical_anchor":"oidc-federation-tokens-get-an-on-disk-cache-with-an-env-over","heading":"OIDC federation tokens get an on-disk cache, with an env override for its location","tier":"use","area":"Auth","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.242\/e\/oidc-federation-tokens-get-an-on-disk-cache-with-an-env-over","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.242","markdown":"### OIDC federation tokens get an on-disk cache, with an env override for its location\n\nFederation tokens are cached on disk, and you can move the cache with a new env var.\n\n**What**\n\nSetups that federate to Anthropic through an OIDC identity token now cache the resulting federation token on disk, so a token is not re-fetched every time. The directory is created mode 0700 and the location can be pointed elsewhere with the new environment variable `CLAUDE_CODE_FEDERATION_CACHE_DIR`.\n\n**Details**\n\n- The cache file name is derived from a hash of the federation rule id, org, workspace, service account, scope, base URL and the identity token, so a change in any of those uses a different file.\n- Caching is refused, with the reason logged and the session continuing uncached, if the directory is group- or other-accessible, is owned by a different user, if no identity token can be read, or if there is no config directory.\n- Only applies when the auth type is OIDC federation and the environment-variable configuration path is in use.\n\n**Evidence**\n\n`CLAUDE_CODE_FEDERATION_CACHE_DIR`\n\n- Area: Auth\n- Names: `CLAUDE_CODE_FEDERATION_CACHE_DIR`\n- Tier: Use it now\n- Useful: 2\/5\n- Signal: 2\/5"}