{"version":"2.1.247","anchor":"gateway-sign-in-and-token-refresh-now-identify-themselves","canonical_anchor":"gateway-sign-in-and-token-refresh-now-identify-themselves","heading":"Gateway sign-in and token refresh now identify themselves","tier":"internal","area":"Auth","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.247\/e\/gateway-sign-in-and-token-refresh-now-identify-themselves","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.247","markdown":"### Gateway sign-in and token refresh now identify themselves\n\nCloud sign-in requests now identify themselves to proxies and identity providers instead of going out anonymous.\n\n**What**\n\nEvery HTTP request in the cloud-gateway authentication flow now carries a `User-Agent` header naming Claude Code, where before they went out unidentified and could be rejected or left unattributable by identity providers and proxies in front of them. The device-authorization step also now sends a form body naming the surface it is signing in from rather than an empty body.\n\n**Details**\n\n- The header is set on OAuth discovery, device authorization and token polling during sign-in, and on the POST that refreshes an existing gateway token, where it sits alongside the form content type already on that request.\n- Affects the gateway login path, which you are put on when managed settings force that sign-in method.\n- A device-authorization endpoint that replies with something unparseable still surfaces its own distinct error, `gateway device authorization endpoint returned malformed response`.\n\n**Evidence**\n\n`\"User-Agent\": pr(),`, `gateway device authorization endpoint returned malformed response`\n\n- Area: Auth\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 2\/5"}