What
Every HTTP request in the cloud-gateway authentication flow now carries a User-Agent header naming Claude Code, where before they went out unidentified and could be rejected or left unattributable by identity providers and proxies in front of them. The device-authorization step also now sends a form body naming the surface it is signing in from rather than an empty body.
Details
- The header is set on OAuth discovery, device authorization and token polling during sign-in, and on the POST that refreshes an existing gateway token, where it sits alongside the form content type already on that request.
- Affects the gateway login path, which you are put on when managed settings force that sign-in method.
- A device-authorization endpoint that replies with something unparseable still surfaces its own distinct error,
gateway device authorization endpoint returned malformed response.
Evidence
"User-Agent": pr(),, gateway device authorization endpoint returned malformed response
Strings lifted out of the shipped bundle, so the claim above can be checked against them.