{"version":"2.1.318","anchor":"refresh-token-expiry-is-now-clamped-on-refresh-and-not-carri","canonical_anchor":"refresh-token-expiry-is-now-clamped-on-refresh-and-not-carri","heading":"Refresh-token expiry is clamped and its warning reworked","tier":"notice","area":"Auth","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.318\/e\/refresh-token-expiry-is-now-clamped-on-refresh-and-not-carri","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.318","markdown":"### Refresh-token expiry is clamped and its warning reworked\n\nA login refresh can no longer push out refreshTokenExpiresAt, and the expiring-login warning now works from a validated date\n\n**What**\n\nWhen you sign in, Claude Code gets a refresh token, a long-lived key it uses to get new short-lived access keys without asking you to sign in again. Refresh tokens can have an expiry time, `refreshTokenExpiresAt`, and the way it is handled changed.\n\n- On sign-in, the new expiry is used only if it is valid.\n\n- On refresh, the earlier expiry is kept and the sooner of the old and new times wins. If there was no valid earlier expiry, it is left unset. Before, the new value was taken if present, otherwise the old one.\n\n- The check that warns about an expiring refresh token now returns the expiry as a date instead of a count of days left, and validates it with a helper instead of a bare number check. The old code appeared to read a missing value.\n\n**Why**\n\nA refresh can no longer stretch the life of a time-limited login. The expiry warning may now show a date instead of a day count, and may work where it did not before.\n\n- Area: Auth\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 2\/5\n- Scope: individual\n- Heads-up: no"}