{"version":"2.1.274","anchor":"first-party-design-auth-now-double-checked-against-request-u","canonical_anchor":"first-party-design-auth-now-double-checked-against-request-u","heading":"First-party design auth now double-checked against request URL","tier":"internal","area":"Auth","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.274\/e\/first-party-design-auth-now-double-checked-against-request-u","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.274","markdown":"### First-party design auth now double-checked against request URL\n\nFirst-party design auth classification now also checks the request URL, not just the token\n\n**What**\n\nThe internal check that classifies a request as using \"first_party_design_auth\" now also requires a URL-based check to pass, in addition to the existing authentication lookup it already performed.\n\n**Why**\n\nThis tightens how Claude Code decides a request qualifies as first-party design authentication, requiring the request's URL to also match expectations rather than relying on the auth lookup alone.\n\n- Area: Auth\n- Tier: Under the hood\n- Useful: 1\/5\n- Signal: 1\/5"}