{"version":"2.1.311","anchor":"second-host-handed-oauth-bearer-for-the-cloud-sessions-api","canonical_anchor":"second-host-handed-oauth-bearer-for-the-cloud-sessions-api","heading":"SDK hosts can hand Claude Code a separate cloud-sessions token","tier":"use","area":"SDK","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.311\/e\/second-host-handed-oauth-bearer-for-the-cloud-sessions-api","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.311","markdown":"### SDK hosts can hand Claude Code a separate cloud-sessions token\n\nApps embedding Claude Code can now supply a second token for the cloud-sessions API via CLAUDE_CODE_SESSIONS_OAUTH_TOKEN or a sessions refresh request\n\n**What**\n\nAn SDK host is an app that runs Claude Code inside itself through the Agent SDK. Such a host could already refresh Claude Code's sign-in token. It can now also supply a second token that authorizes the cloud-sessions API. That token must belong to the same account and organization as the sign-in token.\n\n- `CLAUDE_CODE_SESSIONS_OAUTH_TOKEN` is a new environment variable holding that token. It is added to three credential lists, and one of them strips secrets from the environment.\n\n- When a host sends this variable through `update_environment_variables`, the value is held back and applied only if a validity check passes. Otherwise it goes on the list of refused keys. The handling of `CLAUDE_CODE_OAUTH_TOKEN` in the same place was reworked to refresh credentials after the update.\n\n- The `oauth_token_refresh` request gains an optional `kind: \"sessions\"` that asks the host for the cloud-sessions token. Without `kind`, the request still means the sign-in token, which is all that older hosts know.\n\n- `CLAUDE_CODE_SDK_HAS_SESSIONS_OAUTH_REFRESH` is a new variable a host sets to say it can answer that request. It also turns on the same behaviour as `CLAUDE_CODE_SDK_HAS_OAUTH_REFRESH`.\n\n- Claude Code can now ask when it first needs the token. Before, the request was sent only after a 401 (a rejected request) when there was no local refresh token.\n\n- If the host answers with the sign-in token instead, the answer is ignored with a warning, and cloud-sessions calls keep using the sign-in token.\n\nThis path runs only when the host sets the new variable, Claude Code was started in a way that allows host refresh, and one further check passes.\n\n**Why**\n\nApps that embed Claude Code can give it a separate token just for cloud sessions, and that token is treated as a secret. Without a host that sets the new variable, nothing changes.\n\n- Area: SDK\n- Tier: Use it now\n- Useful: 5\/5\n- Signal: 3\/5\n- Scope: individual\n- Heads-up: no"}