[BUG] Login failure

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Environment

• OS (client): macOS 26 (recently upgraded from macOS 13)
• OS (remote, running Claude Code): Linux (multiple independent HPC systems at different locations)
• Connection: SSH from macOS (both VS Code Remote-SSH and plain Terminal.app), also tested via smartphone tethering (bypassing university network entirely)
• Login methods tested: /login (subscription OAuth), /login (Anthropic Console/API key OAuth), claude setup-token — all failed identically

What's Wrong?

Running /login and completing the browser authorization flow normally results in a short numeric code (e.g. 6 digits) being shown on the "Use authentication code to continue" page. Entering that code into the CLI always fails with:
Auth error: Invalid code. Please make sure the full code was copied

This occurred consistently across:

• Multiple unrelated HPC clusters
• Multiple Anthropic accounts (existing subscription account and a newly created free account)
• Multiple networks (university network and mobile tethering, ruling out proxy/SSL inspection)
• claude setup-token (same error, ruling out subscription-OAuth-specific code path)
• System clock/NTP verified correct and synchronized on all systems
• No proxy environment variables set
• Manual retyping of the code (ruling out clipboard corruption)

What Should Happen?

/login should produce a working authorization URL out of the box, without requiring manual editing, and should consistently return a code format that the CLI can actually redeem.

Error Messages/Logs

### Root cause found
The OAuth authorize URL printed by `/login` contains:
https://......?code=true&client_id=...&response_type=code&redirect_uri=...&scope=org%3Acreate_api_key+user%3Aprofile+...&code_challenge=...&code_challenge_method=S256&state=...

Manually editing the URL before opening it in the browser — removing `code=true&` right after the `?`, and removing `org%3Acreate_api_key+` from the `scope` parameter — causes the browser to instead return a long opaque token-style code (instead of the short numeric one). Entering that long code into the CLI succeeds immediately ("Login successful").

Steps to Reproduce

1. On a fresh/expired-session environment, run claude → /login
2. Select "Claude account with subscription" (or Console option — both affected)
3. Open the printed URL as-is in a browser, sign in, and note the short numeric code shown
4. Enter that numeric code into the CLI → fails with "Invalid code"
5. Re-run /login, this time edit the URL to remove code=true& and org%3Acreate_api_key+ from scope before opening it
6. Complete auth — a long code is now shown instead
7. Enter that code into the CLI → succeeds

Claude Model

Not sure / Multiple models

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

• Claude Code version: 2.1.211

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

VS Code integrated terminal

Additional Information

This may be related to a previously reported issue where the browser shows "Invalid OAuth Request: Unknown scope: org:create_api_key" for the same URL parameters — in our case the browser step succeeded, but the resulting code still failed exchange, suggesting the code=true/org:create_api_key combination causes a subtler server-side inconsistency rather than an outright browser-side rejection.