Sign-in tokens are kept off requests to hosts other than the main API

A bearer token is a credential, sent in a request's header, that proves you are signed in. Claude Code now checks every outgoing web request that carries one. It rewrites the token or removes it unless the request goes to the main API address.

Claude Code still keeps track of tokens that were refused, but now stores a scrambled fingerprint of each one (a hash) instead of the token itself. A token is only used if it has the expected format and is not the token from the previous sign-in. Before, any token that was not empty was accepted.