{"version":"2.1.314","anchor":"oauth-401-recovery-refuses-to-adopt-a-different-stored-login","canonical_anchor":"oauth-401-recovery-refuses-to-adopt-a-different-stored-login","heading":"Handling of host-supplied and environment OAuth tokens tightened","tier":"notice","area":"Auth","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.314\/e\/oauth-401-recovery-refuses-to-adopt-a-different-stored-login","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.314","markdown":"### Handling of host-supplied and environment OAuth tokens tightened\n\nClaude Code no longer swaps a host-supplied login for the one saved on the machine, and treats `CLAUDE_CODE_OAUTH_TOKEN` more carefully\n\n**What**\n\nClaude Code can be signed in by a token handed to it by the program that started it, or through the `CLAUDE_CODE_OAUTH_TOKEN` environment variable (a named value set outside Claude Code). Several places that handle these tokens changed:\n\n- On a 401 (the server refusing the login), a session whose login came from a host-supplied token, including one passed through a file descriptor, no longer switches to the login saved on the machine, because it may be a different account. The new message reads: \"OAuth 401: the login this session is using was refused. The login saved on this machine was not used because it may be a different account. Sign in again in the app that started this session, or run \/login.\"\n\n- The login source is now reported as \"env\" only when the stored access token matches `CLAUDE_CODE_OAUTH_TOKEN` or the other environment token source. Before, any set `CLAUDE_CODE_OAUTH_TOKEN` counted. When the variable is set, the file-descriptor token lookup is skipped.\n\n- `CLAUDE_CODE_OAUTH_TOKEN` is removed from the environment given to shell commands when `dropShellOAuthToken` is set or when a new check passes. Before, `dropShellOAuthToken` was the only condition.\n\n- When `CLAUDE_CODE_OAUTH_TOKEN` is set, loading policy limits now runs the same reset it ran only for credentials not held in the saved store.\n\n**Why**\n\nA session started by another app can no longer quietly change to a different account when its login is refused; you are asked to sign in again instead. If you sign in with `CLAUDE_CODE_OAUTH_TOKEN`, which credential Claude Code uses and whether the token reaches commands it runs may differ from before.\n\n- Area: Auth\n- Names: `CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5\n- Scope: individual\n- Heads-up: yes"}