{"version":"2.1.299","anchor":"remote-managed-settings-stored-copy-trust-and-signature-che","canonical_anchor":"remote-managed-settings-stored-copy-trust-and-signature-che","heading":"Remote managed settings check the stored copy's trust and signature","tier":"notice","area":"Managed Settings","scope":"org","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.299\/e\/remote-managed-settings-stored-copy-trust-and-signature-che","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.299","markdown":"### Remote managed settings check the stored copy's trust and signature\n\nThe saved copy of remote managed settings is now judged against an account and organization pin and a signature, and missing API keys get their own error kind\n\n**Unclear.** What decides whether the checks are enforced or only recorded is not stated.\n\n**What**\n\nRemote managed settings are settings an administrator delivers to Claude Code from Anthropic's servers. Claude Code keeps a copy on disk, a cache, so it can use them between fetches.\n\n- When fetching remote managed settings, Claude Code now judges the cached copy against a stored account and organization pin. Before, it only ran a background comparison of the cache contents.\n\n- It verifies the signature on the live settings against a trusted signer. The check runs either \"enforced\" or in \"shadow\", where it is recorded without being acted on.\n\n- The cache is rewritten differently when a signature is present, and the age of the cache is now reported.\n\n- The sign-in loader gains state for a stored account, a pinned organization for the stored copy, a trust answer that starts as `not_asked`, a refusal, and a remembered sign-in.\n\n- When the sign-in type is an API key but no usable key is available, the fetch now reports `api_key_not_sent` instead of `no_auth_available`. It is treated as a non-error where `no_auth_available` was, and grouped as `client_no_credentials` (no credentials).\n\n**Why**\n\nThese checks make it harder for a tampered or stale settings cache to be applied. Diagnostics can also now tell API-key users apart from users who are not signed in at all.\n\n- Area: Managed Settings\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 3\/5\n- Scope: org\n- Heads-up: no"}