{"version":"2.1.273","anchor":"new-auth-scope-hashing-helper-for-accounttoken-identity","canonical_anchor":"new-auth-scope-hashing-helper-for-accounttoken-identity","heading":"New auth-scope hashing helper for account\/token identity","tier":"internal","area":"Auth","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.273\/e\/new-auth-scope-hashing-helper-for-accounttoken-identity","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.273","markdown":"### New auth-scope hashing helper for account\/token identity\n\nNew hashing helper computes an auth-identity 'scope' for accounts and tokens\n\n**Unclear.** The finding doesn't say what this scope value is used for or why part of the logic is currently disabled.\n\n**What**\n\nNew internal functions compute a hashed 'scope' value that identifies the current login. For logins backed by a stored account (or the `CLAUDE_CODE_ACCOUNT_UUID` source), the scope combines the organization's UUID with a lowercased, hashed, and truncated account UUID. For logins based on an environment variable or file-descriptor auth source, the scope is a hash of the access token instead. A related companion function currently always returns `{scope: null, reason: \"not_claude_ai_auth\"}` because the code path that would compute something else is disabled (guarded by a permanently-false condition).\n\n**Why**\n\nThis groups authentication identities into a consistent hashed form, likely for internal tracking or attribution, though the companion function's dead code means one code path currently never produces a real scope.\n\n- Area: Auth\n- Names: `CLAUDE_CODE_ACCOUNT_UUID`\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 2\/5"}