[BUG] claude remote-control sends NO Authorization header — freshly minted OAuth tokens lack the scope Remote Control requires (macOS, v2.1.177 and v2.1.221)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

[BUG] claude remote-control sends NO Authorization header — freshly minted OAuth tokens lack the scope Remote Control requires (macOS, repro on both v2.1.177 and v2.1.221)

Summary

claude remote-control fails at the Registration phase with:

Error: Registration: Authentication failed (401): Missing Authorization header.
Please provide an OAuth token as a Bearer token.. Remote Control is only available
with claude.ai subscriptions. Please use `/login` to sign in with your claude.ai account.

The key finding: the CLI is not sending the Authorization header at all with any
token minted today, while the same CLI version sent the header this morning with an
older token (server responded "OAuth access token has expired" — proving the header
was transmitted then). This strongly suggests the RC code inspects the stored token's
scopes before attaching it, and tokens currently issued by the claude.ai OAuth flow
no longer include the scope Remote Control requires — so RC silently sends nothing
and the server reports "Missing Authorization header".

This looks like a server-side OAuth scope-issuance change, not a client bug per se:
it reproduces identically on v2.1.177 (which worked hours earlier) and v2.1.221.

Environment

• OS: macOS (Apple Silicon, Mac mini)
• Claude Code: native install at ~/.local/bin/claude
• Versions tested: 2.1.177 and 2.1.221 — identical failure on both
• Account: Claude Max (subscriptionType: max, first-party API)
• claude auth status: loggedIn: true, authMethod: "claude.ai", apiProvider: "firstParty"
• No ANTHROPIC_API_KEY, no CLAUDE_CODE_OAUTH_TOKEN, no proxy env vars
• ~/.claude/settings.json has no endpoint/auth overrides (only model/theme/notification keys)

Timeline / evidence

1. Morning (before app update): claude remote-control (CLI 2.1.177) had been

running fine for weeks (process observed: claude remote-control --name "Mac Mini - Projetos" ...).

1. Desktop app updated (1.24012.9 → 1.25927.0); CLI auto-updated 2.1.177 → 2.1.221

(~/.claude/.last-update-result.json confirms, timestamp 2026-08-04T21:28Z).

1. First RC attempt after update: 401: OAuth access token has expired. Re-authenticate to continue.

→ header was sent; token merely expired.

1. Re-authenticated via every available path:

• interactive /login (claude.ai Max account) — /status confirms logged in
• claude auth login (browser flow, "Login successful")
• fresh /login after downgrading back to 2.1.177

1. Every RC attempt since re-auth: 401: Missing Authorization header — header not sent.
2. Scopes of the freshly minted token (from the Claude Code-credentials Keychain item):

``
['user:file_upload', 'user:inference', 'user:mcp_servers', 'user:profile', 'user:sessions:claude_code']
``

The claude auth login authorize URL requested:
org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload
— nothing resembling a remote-control scope is requested or granted.

1. CLAUDE_CODE_OAUTH_TOKEN from claude setup-token is explicitly rejected:

Remote Control requires a full-scope login token. Long-lived tokens ... are limited to inference-only.
So RC demands a full-scope login token — but current full logins apparently no longer
carry the required scope either.

What was ruled out

• Token validity — Keychain token present, unexpired, subscriptionType: max;

works for normal interactive CLI use in the same shell.

• Client version — identical on 2.1.177 (previously working) and 2.1.221.
• Workspace trust — accepted for the project directory (~/Claude_Workbench);

failure occurs past that gate.

• Env shadowing — no ANTHROPIC_API_KEY / CLAUDE_CODE_OAUTH_TOKEN / proxy vars.
• Credential file vs Keychain — materializing the Keychain JSON into

~/.claude/.credentials.json changes nothing.

• Settings overrides — none (user settings only, no managed settings present).

Steps to reproduce

1. On macOS with a claude.ai Max account, /login (or claude auth login) today.
2. From a trusted project directory:

claude remote-control --name "test"

1. → 401: Missing Authorization header at Registration. No session URL/QR produced.

Relationship to existing issues

• #61551 — RC Registration 401 "Invalid authentication credentials" despite valid Max

(Windows). Same phase; different server message ("invalid" vs "missing header").

• #30093 (closed) — RC bridge-poll 401 despite valid Max (macOS).
• This report adds: header is provably absent, and freshly issued tokens' scope list,

suggesting a scope-issuance regression on the OAuth server rather than a purely
client-side fault.

Impact

Remote Control / Dispatch is fully unusable on this machine since the update; no local
workaround exists (old working token expired and cannot be re-minted).

What Should Happen?

A fresh claude.ai Max login should mint a token carrying whatever scope Remote Control
requires, and claude remote-control should attach it at Registration. If the token
lacks the required scope, the CLI should say so explicitly (as it does for setup-token
tokens) instead of sending an unauthenticated request that surfaces as a confusing
server-side "Missing Authorization header".

Error Messages/Logs

Steps to Reproduce

1. On macOS with a claude.ai Max account, /login (or claude auth login) today.
2. From a trusted project directory:

claude remote-control --name "test"

1. → 401: Missing Authorization header at Registration. No session URL/QR produced.

Relationship to existing issues

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.221

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_