{"version":"2.1.312","anchor":"auth-token-handling-bearer-interceptor-and-refused-token-tr","canonical_anchor":"auth-token-handling-bearer-interceptor-and-refused-token-tr","heading":"Sign-in tokens are kept off requests to hosts other than the main API","tier":"notice","area":"Auth","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.312\/e\/auth-token-handling-bearer-interceptor-and-refused-token-tr","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.312","markdown":"### Sign-in tokens are kept off requests to hosts other than the main API\n\nClaude Code now checks the sign-in token on outgoing requests, and removes or replaces it unless the request goes to the main API address\n\n**What**\n\nA bearer token is a credential, sent in a request's header, that proves you are signed in. Claude Code now checks every outgoing web request that carries one. It rewrites the token or removes it unless the request goes to the main API address.\n\nClaude Code still keeps track of tokens that were refused, but now stores a scrambled fingerprint of each one (a hash) instead of the token itself. A token is only used if it has the expected format and is not the token from the previous sign-in. Before, any token that was not empty was accepted.\n\n**Why**\n\nThis stops old or refused sign-in tokens from being sent to hosts other than the API.\n\n- Area: Auth\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5\n- Scope: individual\n- Heads-up: yes"}