You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
AuthArea: what it touches
ImprovementsKind: in v2.1.300,
ImprovementsSection of the release
What
Managed settings are settings an organisation's administrator controls, for example forceLoginOrgUUID or allowedProviders. Signing in now checks the new login token against the organisation these settings require before the token is saved. If the check refuses it, login fails. This applies to:
the claude_authenticate request used by apps that drive Claude Code
Before, the token was saved first and only checked for validity afterwards. With a refresh token, a refused login now also says the token in CLAUDE_CODE_OAUTH_REFRESH_TOKEN has been used up and a new one must be issued to try again.
Why
In a managed organisation, you can no longer end up signed in with credentials from the wrong organisation. If you provision logins with a refresh token, a refused attempt uses it up, so keep a way to issue another.
claude auth loginClaude Code changelogmodified, high confidence- Improved the error shown when a cloud session is refused because your claude.ai login was rejected or has expired: it now tells you to sign in again with `claude auth login`see the edit
Since it was published
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed sinceAnthropic's documentation has since written up forceLoginOrgUUID, on Deploy with Enterprise Admin Console.* **Allow only your organization:** set [`forceLoginOrgUUID`](/docs/cowork/hipaa-setup#what-each-claude-desktop-key-does) to your Claude organization's ID. This ID isn't [`deploymentOrganizationUuid`](/docs/third-party/claude-desktop/confi…third-party/claude-desktop/admin-consolesee the edit
How sure we are
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agreesclaude auth login on Claude Code changelog
Anthropic's release notes agreeFixed a login refused by forceLoginOrgUUID leaving the refused organization's token stored, or live after /login
