{"version":"2.1.314","anchor":"sessions-api-token-fetch-gains-a-403-guard","canonical_anchor":"sessions-api-token-fetch-gains-a-403-guard","heading":"Session access tokens from environment variables or file descriptors are checked first","tier":"notice","area":"Auth","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.314\/e\/sessions-api-token-fetch-gains-a-403-guard","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.314","markdown":"### Session access tokens from environment variables or file descriptors are checked first\n\nWhen the sessions access token comes from an environment variable or file descriptor, Claude Code can refuse it with a 403 unless it matches the stored token\n\n**Unclear.** It is not clear when this check runs, so it is unknown which setups get the 403.\n\n**What**\n\nWhen Claude Code fetches the access token it uses for its sessions service, it can now run an extra check. If the token came from an environment variable or from a file descriptor (a channel another program passes in), Claude Code returns it only when it matches the stored token. Otherwise it stops with a 403 error, meaning access refused. Before, it returned the token as soon as it found it.\n\n**Why**\n\nIn practice, a token supplied this way may be refused for session features unless it matches the one Claude Code already holds.\n\n- Area: Auth\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5\n- Scope: individual\n- Heads-up: yes"}