### Preflight Checklist - [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet - [x] This is a single bug report (please file separate reports for different bugs) - [x] I am using the latest version of Claude Code ### What's Wrong? Environment Platform: Anthropic API (Claude Max plan) Claude CLI version: [run claude --version] OS: macOS Terminal: iTerm2 Location: Jamaica (multiple d

[BUG] Claude Code Max plan: Second concurrent session triggers Cloudflare 403 challenge instead of proper rate limit error

Resolved 💬 3 comments Opened Mar 3, 2026 by macccoding Closed Mar 7, 2026

Preflight Checklist

[x] I have searched existing issues and this hasn't been reported yet
[x] This is a single bug report (please file separate reports for different bugs)
[x] I am using the latest version of Claude Code

What's Wrong?

Environment

Platform: Anthropic API (Claude Max plan)
Claude CLI version: [run claude --version]
OS: macOS
Terminal: iTerm2
Location: Jamaica (multiple devices/networks)

Bug Description
When running more than one Claude Code session simultaneously on a Max plan, one session gets kicked off with a raw Cloudflare managed challenge HTML response (403) instead of a proper API error. After logging in again via browser, it works for roughly one resume before failing again.
The error is NOT the standard {"error":{"type":"forbidden","message":"Request not allowed"}} — it's the full Cloudflare "Just a moment..." HTML page with cf-mitigated: challenge, which the CLI can't resolve.

Actual behavior: Cloudflare blocks the request entirely with an unsolvable JS challenge, giving no useful error message to the CLI.
Related issues: #24538, #25970, #28450

What Should Happen?

Expected behavior: Either concurrent sessions work as advertised for Max plans, or the API returns a proper JSON error explaining the session limit.

Error Messages/Logs

API Error: 403 <!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta
      name="viewport" content="width=device-width,initial-scale=1"><style>*{box-sizing:border-box;margin:0;padding:0}html{line-height:1.15;-webkit-text-size-adjust:100%;color:#313131;font-family:system-ui,-apple-system,BlinkMacSystemFont,"Segoe
     UI",Roboto,"Helvetica Neue",Arial,"Noto Sans",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"}body{display:flex;flex-direction:column;height:100vh;min-height:100vh}.main-content{margin:8rem
     auto;padding-left:1.5rem;max-width:60rem}@media (width <=
     720px){.main-content{margin-top:4rem}}#challenge-error-text{background-image:url("data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSI+PHBhdGggZmlsbD0iI0IyMEYwMyIgZD0iTTE2IDNhMTMgMTMgMC
     AxIDAgMTMgMTNBMTMuMDE1IDEzLjAxNSAwIDAgMCAxNiAzbTAgMjRhMTEgMTEgMCAxIDEgMTEtMTEgMTEuMDEgMTEuMDEgMCAwIDEtMTEgMTEiLz48cGF0aCBmaWxsPSIjQjIwRjAzIiBkPSJNMTcuMDM4IDE4LjYxNUgxNC44N0wxNC41NjMgOS41aDIuNzgzem0tMS4wODQgMS40MjdxLjY2IDAgMS4wNTcuMzg4LjQwNy4zODkuNDA3Ljk5NCAw
     IC41OTYtLjQwNy45ODQtLjM5Ny4zOS0xLjA1Ny4zODktLjY1IDAtMS4wNTYtLjM4OS0uMzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+");background-repeat:no-repeat;background-size:contain;padding-left:34px}</style><meta
     http-equiv="refresh" content="360"></head><body><div class="main-wrapper" role="main"><div class="main-content"><noscript><div class="h2"><span id="challenge-error-text">Enable JavaScript and cookies to
     continue</span></div></noscript></div></div><script>(function(){window._cf_chl_opt = {cvId: '3',cZone: 'api.anthropic.com',cType: 'managed',cRay: '9d6a7c47af8f25af',cH: 'sAliQlGiFmF3VAI00TsbOqyFbeDUhERuDWlzRZ4yEDI-1772560247-1.2.1.1-ZrHkYrrzukn3uXG8b8Um5T4op
     CX6N2dq3YapkkMHLUv8GNPlVoS2gJ7y6ny0dCxw',cUPMDTk:"/v1/messages?beta=true&__cf_chl_tk=BndspK_Dk0PPIhOgdSSg36_P4azPxdLz6OhL.Oc0GR0-1772560247-1.0.1.1-xk0HUTS4NzUP6FyXT6YCd9PJHj4zqsL0a.RW9PGd2zg",cFPWv: 'g',cITimeS: '1772560247',cTplC:0,cTplV:5,cTplB:
     '0',fa:"/v1/messages?beta=true&__cf_chl_f_tk=BndspK_Dk0PPIhOgdSSg36_P4azPxdLz6OhL.Oc0GR0-1772560247-1.0.1.1-xk0HUTS4NzUP6FyXT6YCd9PJHj4zqsL0a.RW9PGd2zg",md:
     'SKjce22GoXz1P.mvW45eI5Ppp3nVOP6GmcCxbUTxDbo-1772560247-1.2.1.1-LbWA6W5hDnSy_1DiqqlLb7BuhmILF0uHYBOyKsRkGshvyvmqeT8KYlrT957LvzS8PV80TWThjSzOBxpAR8utX73pzAxPjVN2L88tFZb1.zakqZ9t1pwsiOFLDXEtQ8Y5AwAaHc0kP5H7E07L6h_Yt6oqArlUu_RFYhkiLMTatzd7vbrPnPo6ZrQ3152yUppY9Q
     K54ZsNrRLc1yLsqyRCs8z69.0sOZrlFARPitjqj6eKKlz3_xZf3JsnulY1n3Ko7UgVix8wcUuLy_PZjZ2M1YJ1JD8Jlc6gfIJ0w.Ud3hK2wn.JsPZxz6MlVWAc6EoCfsRD.mUeXOnQv49WhzYm3W_85ckSeqZgiZ4H0GptOxKZ9aQX_5npoWS7laepxQBsu1l.thDDZ5mCH__Gvy5.U4lrRllWZRd53QGWH.cmb60A1lIqdNAnyRqeAYWZlONl6Z1m
     5nJnAan8FfRVCx2HWwr_nIUNZeKC2jauVvjyFw3NZ_TM780RjWjDaqB717ZtLPlRALuW3eHW3CcnMqcwtpj6V5uQr3xX_D9fnRtJI1q7sokg9SaoD3aHLN.5mEP8vHP0eLAdZdheTmlFCgJxe_O59CABKBL1RYxLLERD.nrnDVj3TbEXtKaRXH5Da_jU8QGD_XnBY9n9a64n_3bfcAmryftJA9O4PeznhYVzEwN2IgaMnFI0dWNHkzPyGzR4d410XV
     2L6BlxLUNaPhXa9Gdcy2M1zUdGe2zJQYq6jV1dxjOxD3B.ZVe.pOWSoiZb4aPniau.HWhmmKU18wV7h.LBospBMyCf.YhT0Ki2nQR6WHdjHjKQ3BibhTR1AJKZ',mdrd: '',};var a = document.createElement('script');a.src =
     '/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=9d6a7c47af8f25af';window._cf_chl_opt.cOgUHash = location.hash === '' && location.href.indexOf('#') !== -1 ? '#' : location.hash;window._cf_chl_opt.cOgUQuery = location.search === '' &&
     location.href.slice(0, location.href.length - window._cf_chl_opt.cOgUHash.length).indexOf('?') !== -1 ? '?' : location.search;if (window.history && window.history.replaceState) {var ogU = location.pathname + window._cf_chl_opt.cOgUQuery +
     window._cf_chl_opt.cOgUHash;history.replaceState(null, null,"/v1/messages?beta=true&__cf_chl_rt_tk=BndspK_Dk0PPIhOgdSSg36_P4azPxdLz6OhL.Oc0GR0-1772560247-1.0.1.1-xk0HUTS4NzUP6FyXT6YCd9PJHj4zqsL0a.RW9PGd2zg"+ window._cf_chl_opt.cOgUHash);a.onload = function()
      {history.replaceState(null, null, ogU);}}document.getElementsByTagName('head')[0].appendChild(a);}());</script></body></html>

Steps to Reproduce

Log in to Claude Code in iTerm2 using a Claude Max plan subscription
Start a Claude Code session in one terminal tab/window (works normally)
Open a second terminal tab/window and start another Claude Code session
Begin working in either session — send a prompt or resume a conversation
The other session returns a 403 with raw Cloudflare managed challenge HTML instead of a valid API response
Close the errored session and re-authenticate via browser login
It works for approximately one prompt/resume, then the 403 Cloudflare HTML returns again
Check usage at claude.ai/settings — session and weekly limits are nowhere near capacity

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.63 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

iTerm2

Additional Information

_No response_

View original on GitHub ↗

This issue has 3 comments on GitHub. Read the full discussion on GitHub ↗