The remote-session identity resolver, which derives organizationUuid, accountUuid, and emailAddress, now caches its result per host and reads its token through a new internal helper instead of reading CLAUDE_CODE_SESSION_ACCESS_TOKEN directly. This avoids repeated JWT parsing when the token hasn't changed.
Names in the bundleCLAUDE_CODE_SESSION_ACCESS_TOKEN
Documented inclaude-code/self-hosted-environments-configuration
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Added since
A small documentation edit on Customize sessions in self-hosted environments touched a line naming CLAUDE_CODE_SESSION_ACCESS_TOKEN after this was published.
| `CLAUDE_CODE_SESSION_ACCESS_TOKEN` | The session JWT, prefixed `sk-ant-cc-`. Its `act` claim identifies the session creator, with the creator's email when the creating surface recorded it. The value is the token at spawn time; refreshes …self-hosted-environments-configuration see the edit
Confirmed since
Anthropic's documentation has since written up CLAUDE_CODE_SESSION_ACCESS_TOKEN, on Customize sessions in self-hosted environments.
| `CLAUDE_CODE_SESSION_ACCESS_TOKEN` | The session JWT, prefixed `sk-ant-cc-`. Its `act` claim identifies the session creator, with the creator's email and upstream identity-provider subject when the creating surface recorded them. The val…self-hosted-environments-configuration see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up CLAUDE_CODE_SESSION_ACCESS_TOKEN, on Customize sessions in self-hosted environments.