{"version":"2.1.300","anchor":"oauth-login-paths-gain-an-org-pin-verification-step-before-c","canonical_anchor":"oauth-login-paths-gain-an-org-pin-verification-step-before-c","heading":"Login now checks your organisation before saving new credentials","tier":"notice","area":"Auth","scope":"org","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.300\/e\/oauth-login-paths-gain-an-org-pin-verification-step-before-c","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.300","markdown":"### Login now checks your organisation before saving new credentials\n\nSigning in now checks the new token against the organisation required by managed settings before saving it, and fails if it does not match\n\n**What**\n\nManaged settings are settings an organisation's administrator controls, for example `forceLoginOrgUUID` or `allowedProviders`. Signing in now checks the new login token against the organisation these settings require before the token is saved. If the check refuses it, login fails. This applies to:\n\n- the `claude_authenticate` request used by apps that drive Claude Code\n\n- `claude auth login` through the browser\n\n- `claude auth login` using a refresh token from `CLAUDE_CODE_OAUTH_REFRESH_TOKEN`\n\nBefore, the token was saved first and only checked for validity afterwards. With a refresh token, a refused login now also says the token in `CLAUDE_CODE_OAUTH_REFRESH_TOKEN` has been used up and a new one must be issued to try again.\n\n**Why**\n\nIn a managed organisation, you can no longer end up signed in with credentials from the wrong organisation. If you provision logins with a refresh token, a refused attempt uses it up, so keep a way to issue another.\n\n- Area: Auth\n- Names: `forceLoginOrgUUID`, `allowedProviders`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5\n- Scope: org\n- Heads-up: yes"}