{"version":"2.1.271","anchor":"oauth-scope-default-no-longer-hardcodes-userinference","canonical_anchor":"oauth-scope-default-no-longer-hardcodes-userinference","heading":"OAuth scope default no longer hardcodes 'user:inference'","tier":"notice","area":"Auth","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.271\/e\/oauth-scope-default-no-longer-hardcodes-userinference","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.271","markdown":"### OAuth scope default no longer hardcodes 'user:inference'\n\nCLAUDE_CODE_OAUTH_SCOPES no longer defaults to 'user:inference' when unset\n\n**What**\n\nWhen using a refresh token to log in to Claude Code non-interactively via `CLAUDE_CODE_OAUTH_REFRESH_TOKEN`, the `CLAUDE_CODE_OAUTH_SCOPES` environment variable (a space-separated list of OAuth scopes the refresh token was issued with, such as `\"user:profile user:inference user:sessions:claude_code\"`) previously defaulted to `[\"user:inference\"]` when left unset. It now has no default at all, returning nothing if the variable isn't set.\n\n**Why**\n\nSince `CLAUDE_CODE_OAUTH_SCOPES` is required whenever `CLAUDE_CODE_OAUTH_REFRESH_TOKEN` is set, removing the silent default means a missing value is no longer papered over with an assumed scope, which could otherwise mask a misconfiguration.\n\n- Area: Auth\n- Names: `CLAUDE_CODE_OAUTH_SCOPES`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}