{"version":"2.1.307","anchor":"launcher-host-sign-in-for-the-desktop-app-is-new-in-this-bui","canonical_anchor":"launcher-host-sign-in-for-the-desktop-app-is-new-in-this-bui","heading":"Host-managed sessions can sign in with a token, including one handed over by the desktop app","tier":"use","area":"Auth","scope":"both","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.307\/e\/launcher-host-sign-in-for-the-desktop-app-is-new-in-this-bui","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.307","markdown":"### Host-managed sessions can sign in with a token, including one handed over by the desktop app\n\nWith CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST, a supplied OAuth token now wins over host management, and a new path accepts a sign-in token from the desktop app\n\n**What**\n\n`CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST` is an environment variable (a named value set outside Claude Code) that tells Claude Code another program hosting it handles the model connection. This release changes how sign-in works in that mode.\n\n- A supplied OAuth token (sign-in token) now takes priority. The session counts as host managed only when no OAuth token is available. The token check now passes when `CLAUDE_CODE_OAUTH_TOKEN` is set or another token source is present, and such a token also satisfies the check for required credentials.\n\n- The same rule applies to the missing-credential error, to the check that sign-in is limited to your organisation, and to telling apart unix socket and host-managed connections. A related message, `managed_by_host_under_method_pin`, was added.\n\n- A new launcher sign-in path can hold a claude.ai token handed over by the program that started Claude Code, such as the desktop app. It is only active when `CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST` and `CLAUDE_CODE_HOST_AUTH_ENV_VAR` are set, and `CLAUDE_CODE_DISABLE_LAUNCHER_SIGN_IN` switches it off.\n\n- Before using that token it checks many conditions: third-party providers, a custom base URL, a unix socket, custom OAuth, launcher credentials, machine policy, and `forceLoginMethod` set to console. It can swap the token during the session and drops it when any condition stops holding, logging '[launcher-host-login] the desktop app's sign-in is over for this process'.\n\n- The last condition is a remote switch, `tengu_kestrel_lantern`, which the code reads with a default of true, so only an explicit false from the server turns this path off. Nothing has been read about how it is set.\n\n**Why**\n\nIf you run Claude Code inside another app that manages the connection but also supply a token, that token is now used instead of the host's own route. Sessions started from the desktop app can use its claude.ai sign-in directly, and `CLAUDE_CODE_DISABLE_LAUNCHER_SIGN_IN` is there if you need to turn that off.\n\n- Area: Auth\n- Names: `CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST`, `CLAUDE_CODE_HOST_AUTH_ENV_VAR`\n- Tier: Use it now\n- Useful: 4\/5\n- Signal: 3\/5\n- Scope: both\n- Heads-up: yes"}