[BUG] OAuth login fails with Cloudflare challenge (cf-mitigated: challenge) on macOS - Claude Max subscription

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Claude Code /login command times out with OAuth error: timeout of 15000ms exceeded
on macOS. The browser opens successfully and authentication completes on Anthropic's side,
but the CLI never receives the callback token.

Diagnosing the issue with curl -v https://claude.ai/oauth/authorize reveals the root cause:
Cloudflare is returning a cf-mitigated: challenge response (HTTP 403) to the CLI request,
blocking the OAuth token exchange. The challenge requires JavaScript execution, which the
CLI callback handler cannot satisfy.

What Should Happen?

After completing authentication in the browser, the CLI should receive the OAuth token
callback successfully and authenticate the Claude Max subscription session without timeout.

Error Messages/Logs

OAuth error: timeout of 15000ms exceeded

Press Enter to retry.

--- curl diagnostic output ---
< HTTP/2 403 
< cf-mitigated: challenge
< server: cloudflare
< cf-ray: 9dabb4681a67523b-MEX

Response body: "Just a moment..." (Cloudflare JS challenge page)

Steps to Reproduce

1. Install Claude Code: curl -fsSL https://claude.ai/install.sh | bash
2. Run: claude
3. Run: /login
4. Browser opens — complete authentication successfully (browser shows success)
5. Terminal never receives callback — times out after 15 seconds with:

"OAuth error: timeout of 15000ms exceeded"

1. To confirm root cause, run:

curl -v https://claude.ai/oauth/authorize

1. Observe: HTTP 403 with headers cf-mitigated: challenge from Cloudflare

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.72

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

• Tried: full uninstall/reinstall, rm -rf ~/.claude, multiple networks (WiFi + mobile hotspot)
• Tried: macOS restart, different DNS servers (8.8.8.8, 1.1.1.1)
• api.anthropic.com and claude.ai resolve correctly via DNS
• No VPN, no Little Snitch or third-party firewall installed
• Location: Mexico City, Mexico (cf-ray ends in -MEX, suggesting Cloudflare edge in MEX

may be misconfigured)

• claude.ai works normally in browser — issue is specific to CLI OAuth callback
• Workaround: using ANTHROPIC_API_KEY env var (consuming API credits instead of Max plan)