{"version":"2.1.86","anchor":"trusted-device-enrollment","canonical_anchor":"trusted-device-enrollment","heading":"Trusted Device Enrollment","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.86\/e\/trusted-device-enrollment","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.86","markdown":"### Trusted Device Enrollment\n\n**What**\n\nClaude Code now automatically enrolls your device as a trusted device, sending a `X-Trusted-Device-Token` header with API requests for enhanced session security.\n\n**Details**\n\n- Enrollment happens automatically in the background when you're logged in via OAuth\n- Device is registered with the display name `Claude Code on <hostname> \u00b7 <platform>`\n- The token is persisted locally and reused across sessions\n- You can override with the `CLAUDE_TRUSTED_DEVICE_TOKEN` environment variable\n- Enrollment can be skipped in essential-traffic mode\n\n**Evidence**\n\nTrusted device enrollment flow (search for `\"[trusted-device] Enrolled device_id=\"`) \u2014 gated by `tengu_sessions_elevated_auth_enforcement` flag\n\n**[Gradual Rollout]** \u2014 gated by the `tengu_sessions_elevated_auth_enforcement` feature flag.\n\n- Flag `tengu_sessions_elevated_auth_enforcement`: On for this account, and not off by default (read for one account on one subscription tier against v2.1.86; this account: on, anonymous baseline: on, compiled default: no gate table built for this version) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release."}