Under the hood
Claude Code adds an encrypted local-pairing handshake for connecting to the Claude-in-Chrome extension
What
Claude Code now includes a new subsystem for establishing a secure, end-to-end encrypted connection to the Claude-in-Chrome browser extension, called "local pairing." It uses ECDH key exchange (a way for two parties to agree on a shared secret) over the P-256 curve, HKDF key derivation, and AES-GCM encryption to build a sealed communication channel, alongside the existing plain local socket bridge.
The system includes:
- JWT-based attestation checked against an issuer and JWKS endpoint (
/api/oauth/local_pairing/attestand/api/oauth/local_pairing/jwks.json) - pairing offer/accept/done handshake messages
- sealed request/response message framing
- liveness probing to detect a dropped connection
- pairing-state callbacks (
onPairingState) reporting states likepairing,established,refused, andclosed
Why
This strengthens the connection between Claude Code and the Claude-in-Chrome extension by encrypting and authenticating the pairing handshake, rather than relying on a plain local socket.