Unclear It is not clear when this check runs, so it is unknown which setups get the 403.
What
When Claude Code fetches the access token it uses for its sessions service, it can now run an extra check. If the token came from an environment variable or from a file descriptor (a channel another program passes in), Claude Code returns it only when it matches the stored token. Otherwise it stops with a 403 error, meaning access refused. Before, it returned the token as soon as it found it.
Why
In practice, a token supplied this way may be refused for session features unless it matches the one Claude Code already holds.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
It is not clear when this check runs, so it is unknown which setups get the 403.