OAuth token expired / refresh failed — page 2
The stored OAuth token lapsed and the refresh did not recover it.
399 issues · 84 open · 315 resolved (79%) · first seen May 7, 2025
First response · account
What to do now
Most likely: Authentication, usage state or session size blocked the request.
- Check the exact account, organization and usage window currently selected.
- Try a new short session before deleting credentials or local history.
- If the state is inconsistent across machines, preserve diagnostics and re-authenticate once.
These are conservative triage steps, not an official Anthropic fix. Use the issue and workaround evidence below before making a destructive configuration change.
Is this getting better or worse?
This class of problem is still growing. 121 new reports in the last 90 days vs 89 in the 90 before — +36%. The open backlog peaked at 94 in 2026-08 and sits at 84 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
233 of these reports name the Claude Code build they were running, spanning 126 releases. Heaviest reporters:
- Claude Code v2.1.220
- Claude Code v2.1.229
- Claude Code v2.1.39
- Claude Code v2.1.260
- Claude Code v2.1.119
- Claude Code v2.1.81
- Claude Code v2.1.206
- Claude Code v2.1.203
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 29 days across 315 closures. Of the 315 closures with a recorded reason, 15% were closed as completed and 269 as not-planned or duplicate. The most recent completed fix landed in 2026-10.
Workarounds reported by the community
143 of these issues post a workaround someone says worked. The highest-engagement ones:
- [FEATURE] Enable Claude Code to access chat history in Claude App
- …opt-in, no sync needed in the other direction. The current workaround (manually summarizing and pasting context) defeats the entire purpose of persistent memory and cross-session continuity that Anthropic is actively bu…
Found in the thread of #15542 · still open - Missing Token Refresh Mechanism for MCP Server Integrations
- …ll, it's an option. I notice Linear's MCP server chose that workaround too: their access tokens expire in 7 days by default. But I don't think it's the right solution, and neither do the MCP protocol authors, [who say](…
Found in the thread of #5706 · resolved - Frequent re-authentication required with multiple concurrent Claude Code sessions (OAuth refresh token race condition)
- …rocesses share a single token manager that handles refresh. Workaround Currently, the only workaround is to close stale Claude Code sessions to reduce the number of concurrent processes competing for token refresh. This…
Found in the description of #24317 · resolved - [BUG] OAuth token expiration disrupts autonomous workflows – refresh token handling needed
- …t working, giving the same error message again Update: Temp workaround is to go to the folder and start Claude CLI with , then continue the session from there.
Found in the thread of #12447 · still open - [BUG] MCP OAuth: Claude doesn't auto-refresh access tokens, daily "Connection expired" despite valid refresh token
- …ions stall when access tokens expire mid-workflow. The only workaround is the community local bridge, which requires per-laptop install. Cross-platform — not Windows-specific. Confirmed by multiple colleagues at our org…
Found in the description of #65036 · still open
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 101–200
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 399 matches; the statistics above cover all 399.
- OAuth auto-refresh fails in non-interactive (subprocess) mode → 401 after token expiry
- [BUG] Rate limits too aggressive for Pro plan (90€/month)
- OAuth access token not auto-refreshed — daily re-login required for subscription users
- [BUG] OAuth tokens expire silently, breaking unattended automation (LaunchAgent/cron)
- [FEATURE] Share MCP OAuth tokens globally for user-scoped servers instead of per-project
- [BUG] Custom MCP connector loses OAuth authentication after ~1-2 hours (refresh token not used)
- [BUG] Slack MCP plugin: 1-hour token expiry with no refresh token forces frequent re-authentication
- macOS Keychain credential corruption: security -i 4096-byte line buffer causes OAuth token refresh failures
- `allowed-tools:` silently ignored in agent frontmatter — subagent inherits all parent tools, leading to credential hunting
- OAuth token refresh race condition with multiple concurrent sessions on same machine
- [Bug] v2.1.37 regression: OAuth authentication fails in sdk-cli/headless mode on macOS (cron-spawned processes)
- [BUG] `/mcp reconnect` doesn't refresh expired OAuth access tokens for HTTP MCP servers
- [Bug] Context window exhaustion causes multi-agent freeze
- Remote Control auto-start reports "re-login required" when the OAuth refresh simply hasn't landed yet (credential still renewable)
- MCP OAuth: stale dynamic client registration replayed forever after server prunes it ("Unrecognized client_id"); no clear-auth option in /mcp
- [BUG] macOS: token rotations persist to Keychain only while /login writes .credentials.json only — store split-brain revokes the token family, forcing repeated re-login
- Credential writes replace symlinks and clobber shared state: concurrent instances sharing .credentials.json cascade each other (and the user) to logged-out
- [Bug] Anthropic API Error: insufficient_scope not triggering step-up authorization flow
- Subscription-OAuth long-running Remote Control session dead-ends at 401 / "Please run /login" at the daily refresh boundary; /login cannot complete in a remote-controlled session
- [BUG] VS Code extension prompts re-login on every PC restart when access token is expired at startup
- [BUG] CLI is unrecoverable when returning to an expired session — /login and all inputs fail with 403
- OAuth MCP connectors: random mid-session "disconnected" requiring /mcp Reauthenticate (persistent across versions)
- Slack MCP (mcp.slack.com) OAuth stores empty accessToken after completing flow; complete_authentication also broken
- [BUG] HTTP MCP OAuth tokens written to macOS Keychain but not loaded at session start — re-auth required every session
- /mcp list view shows "connected" for HTTP MCP servers that lack valid OAuth — auth state not surfaced
- [BUG] Multiple custom MCP connectors stopped working simultaneously with "Couldn't reach the MCP server" error
- Plugin hooks that refresh OAuth tokens silently break authentication
- [BUG] 401 after successful /login on 2.1.87 — token not persisting FOR 12+ hours and 10+ attempts with success print
- [BUG] Unable to use Claude Code Web - Endless Timeouts
- Authentication method unexpectedly switched from Claude Max to Claude API mid-session
- [BUG] MCP server named "supabase" ignores stdio configuration and forces SSE/OAuth connection
- OAuth token expires when using Claude Code on multiple devices
- [BUG]
- [BUG] OAuth token has expired 라고해서 /login 했더니 cloudflare 500 에러 뜨는데 이러면 클로드코드를 어떻게 써야하나요?
- [BUG] Using Max 200 Plan but Charged for API Usage!
- [BUG] Claude Projects: every cloud thread is server-side bound to the desktop device (config:claude-code-device-bind), which blocks egress writes and Google OAuth refresh; only fix ("Require trusted devices") disables project Remote Control
- Windows: refresh-token rotation not persisted to .credentials.json; failed refresh blanks the store, locking out all fresh processes (2.1.220)
- [BUG] Gateway provider discards the refresh token and has no refresh-token grant, so every renewal is a full device-code re-grant
- [BUG] Cross-session message written to target transcript but excluded from model's context
- HTTP MCP: valid token treated as expired — "OAuth session expired and could not be refreshed" when provider issues no refresh token (mcp.facebook.com/ads)
- [BUG] Claude Code unexpectedly clears OAuth tokens and requires full re-authentication before refreshTokenExpiresAt
- [FEATURE] Bridge local stdio MCP servers into cloud Cowork sessions
- [BUG] 2.1.218 (native build): OAuth MCP servers report "requires authentication" in --print/headless sessions despite valid keychain tokens (regression from 2.1.210)
- MCP OAuth storage wiped mid-session (no update involved); CLI silently registers a new dynamic client, breaking auth for all remote MCP servers
- Repeated mid-session logouts on macOS with concurrent instances sharing one Keychain OAuth chain
- Single failed proactive token refresh hard-wipes auth and traps every session in an uncompletable /login
- [Bug][harness] ClAudit: auto-mode classifier denied — The action reads the MSAL token cache to extract a user refresh token
- [DOCS] Errors reference omits the "Your organization has disabled API key authentication" message and v2.1.169 guidance about which credential source to check
- [Feature Request] Add timestamp display for conversation interactions
- 3P Bedrock SSO: credentials silently expire without triggering re-auth on day 2+
- Indeed MCP OAuth fails with `invalid_client / Client not allowed` — same pattern as #47185
- Gmail MCP connector: write operations (label_thread/archive/trash) fail in remote routines due to JIT scope upscoping
- HTTP MCP OAuth: refresh token not used; client drops to bootstrap tools when access token expires
- [DOCS] Authentication docs omit OAuth refresh behavior when the server revokes a token early
- [BUG] 401 Authentication Error — OAuth token rejected on all servers despite valid Max 20x subscription
- Vercel MCP plugin OAuth token not persisted between sessions
- MCP OAuth writes corrupt shared credential store, causing Team plan logout across all sessions
- OAuth token expires daily, no way to re-auth over SSH — locked out for 6 days while traveling
- OAuth token expired — login/logout/all commands fail with 401, no recovery path
- [BUG] inaccurate feedback during system outages
- Supabase MCP plugin requires daily re-authentication
- Add automatic MCP server health check on session start
- OAuth token refresh fails in non-interactive/headless mode
- [BUG] Step-up authorization not working for scope elevation in MCP TypeScript SDK
- [BUG] OAuth login fails with "Failed to start OAuth callback server: Failed to start server. Is port 0 in use?
- [BUG] API ERROR 401 after login on Ubuntu
- Deel MCP OAuth fails: redirect_uris must use HTTPS protocol
- [FEATURE] Save user input to clipboard when permission prompt steals focus
- [BUG] Claude Code can't find refresh_token in connecting with MCP Server using OAuth
- [Bug] Claude Code freezes with token consumption but no task progress
- I am getting this API error more frequently it seems over...
- [Bug] Terminal UI Flickering and Inconsistent Code Generation Behavior
- OAuth Token Refresh Failure During Active Session
- Desktop SSH remote session fails with "401 OAuth access token is invalid" while the claude CLI on the same host, same user, same credentials file works
- macOS: Claude Code accumulates a new Keychain credential entry per login (110 in 5 weeks) and fails to reuse them, causing repeated forced re-auth
- MCP OAuth: valid stored token for mcp.facebook.com/ads reported as "OAuth session expired and could not be refreshed" (issuer mismatch, no refresh token)
- `claude remote-control` server exits on 401 after exactly 24h — does not refresh its OAuth access token, killing every attached session
- [BUG] HTTP MCP: OAuth succeeds, then initialize hangs until CONNECT_TIMEOUT (raising MCP_TIMEOUT doesn't help)
- Setup-token auth silently downgrades Fable 5 to Sonnet 5 (subscriptionType missing from token profile) — forces fleets back onto fragile stored /login auth
- Read tool displays secret file contents in plaintext with no redaction, even when user only asked for a path
- Desktop app /mcp gallery lacks reauthenticate state and per-session server visibility (vs terminal)
- Local CLI auth expires every ~12h during long-running Remote Control sessions (personal Max) — forced /login; docs claim credentials auto-refresh
- MCP OAuth DCR fails for Calendly: client_name "Claude Code (<server>)" rejected as invalid_client_metadata (recurrence of #59445)
- Claude Max subscribers required to re-authenticate daily — OAuth refresh token TTL too short
- [BUG] Successful auto-retry after api_error orphans the assistant turn: stop_hook_summary + next user message get parented to the api_error node instead of the recovered reply
- [BUG] Don't surface never-connected first-party connectors (Gmail/Calendar/Drive) as startup action items in Claude Code
- [BUG] Windows: /login authorization-code prompt accepts no input (type or paste) while the main REPL composer works — interactive login impossible
- Remote OAuth MCP server shows "✔ Connected" but registers 0 tools in-session (Linear / mcp.linear.app)
- [BUG] /login → Third-party → Claude Platform for AWS re-auth loops back to the top-level login menu; underlying 401 retries ~10× before surfacing
- [Bug] HTTP/SSE MCP OAuth client doesn't persist refresh_token for offline_access
- Re-authentication required after every clean restart due to auto-update wiping credentials
- [BUG] VS Code extension requires re-authentication every ~8 hours — OAuth token refresh blocked by Cloudflare
- [BUG] MCP OAuth refresh token being used 4 days after it was already refreshed
- [BUG] MCP OAuth: token exchange silently fails for Robinhood MCP servers -- empty accessToken persisted, empty error from complete_authentication (manual exchange with identical params succeeds)
- Stale OAuth refresh token causes persistent 401 "Invalid authentication credentials" that `/login` does not recover from (manual deletion of ~/.claude/.credentials.json required)
- Notion MCP token invalidated after context compaction, requires re-authorization every session
- claude.ai connector via mcp-proxy.anthropic.com rejected with mcp_unauthorized_after_token_refresh while claude.ai backend uses the same grant successfully (OAuth 2.1 refresh rotation race)
- CLI auto-logout after ~8h idle: expired access token not silently refreshed via refresh token
- [FEATURE] Inline option selection with feedback in Plan Mode
- [FEATURE] Persist MCP OAuth client registrations and refresh tokens across CLI launches