Sign-in now checks your organization's configuration and reloads its settings

What

When you sign in with your Claude account through the browser (the OAuth sign-in flow), Claude Code now checks your organization's configuration before it saves the new credentials. Your organization's policy can therefore refuse a sign-in.

• A refused sign-in revokes the token that was just issued, so it can no longer be used, and the error is shown to you.
• claude setup-token, the command that creates a long-lived sign-in token, now ends when the sign-in is refused. Its sign-in screen gained an onOrgConfigRefused callback (a step that runs when this happens) next to the existing onAccountOnHold, and the command exits with an org_config_refused status.
• The onboarding, login and session-resume dialogs now reload your organization's documents and settings after sign-in, through the new onOrgDocumentsReload and onSettingsReload callbacks and an orgConfigGateFollows option.
• The error shown when --bg (start a session as a background agent) is combined with bypass-permissions mode now tells you when your user settings are not being read.

Why

If you work under an organization that manages Claude Code, signing in or creating a token can now fail because of that organization's policy, and the failure is reported instead of the token being kept. Organization-managed settings are reloaded as part of signing in.