Claude Code can now tell when your token is a bot or service account with no user behind it.
What's wrong with this entry?
New checks read the auth token's claims to tell whether it is acting as a bot or belongs to a service account, which have no user identity attached.
- Bot detection accepts
act_as_botas either a boolean true or the string "true". - A service account is identified by having no account UUID and no subject, but non-empty
org_service_nameandcode_agent_id.
code_agent_id
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.234
Signing back into the same account keeps a pending auto-resume
Both mention auth
-
v2.1.234
Token screen reports actual remaining validity
Both mention auth
-
v2.1.234
Setup-token login result carries the expiry
Both mention auth