{"version":"2.1.312","anchor":"sessions-401-bearer-report-tightened","canonical_anchor":"sessions-401-bearer-report-tightened","heading":"Stricter handling when a sessions request is refused for a bad sign-in token","tier":"internal","area":"Auth","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.312\/e\/sessions-401-bearer-report-tightened","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.312","markdown":"### Stricter handling when a sessions request is refused for a bad sign-in token\n\nReporting of rejected sign-in tokens on sessions requests now only happens when an extra check on the request passes\n\n**What**\n\nWhen a request to the sessions service is refused with a 401 error (the server's answer for \"not signed in or token not accepted\"), Claude Code can report the sign-in token that was sent. That report now only happens when the request passes an extra check. Claude Code also now reads the token out of the request's sign-in header with a dedicated parser, instead of simply cutting off the text \"Bearer \" at the start.\n\n**Why**\n\nThis narrows the cases in which a rejected token is reported.\n\n- Area: Auth\n- Tier: Under the hood\n- Useful: 1\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: no"}