Intermittent oauth_org_not_allowed (403) blocking Claude Code CLI despite valid Claude Max subscription — web Code access unaffected

Description

Claude Code CLI intermittently rejects requests with a 403 oauth_org_not_allowed error and displays: "Your organization has disabled Claude subscription access for Claude Code · Use an Anthropic API key instead, or ask your admin to enable access" — even though the account has an active, valid Claude Max personal subscription, and Claude Code on the web (claude.ai/code) works fine for the same account at the same time.

Account details

• Account: siaminjapan@gmail.com (personal Claude Max subscription, stripe_subscription, organizationRateLimitTier: default_claude_max_5x)
• Organization: auto-created personal org, UUID 5513e847-2e0a-44fd-951a-8b9ebc877c08
• organizationRole: admin (sole member — this is a personal account, not a team)

Evidence of intermittency

Two consecutive CLI sessions launched seconds apart, same machine, same OAuth credential:

1. Session A — banner showed Opus 5 (1M context) · Claude Max · siaminjapan@gmail.com's Organization, responded normally to a test message.
2. Session B (launched immediately after quitting Session A) — first message failed instantly with:

``
error: oauth_org_not_allowed
apiErrorStatus: 403
requestId: req_011CeZyvXGBcNT3wLSUK6ECx
timestamp: 2026-08-31T01:46:26Z
``

Troubleshooting already performed (ruled out local causes)

• Fully deleted and recreated the CLI config directory (CLAUDE_CONFIG_DIR) — worked briefly, then failed again ~10 hours later with no changes on our end.
• Cleared all locally cached entitlement fields (cachedExtraUsageDisabledReason, modelAccessCache, etc.) from .claude.json — the very next fresh check from the server returned org_level_disabled / hasExtraUsageEnabled: false again.
• Deleted the macOS Keychain OAuth credential entirely and re-authenticated from scratch — same intermittent failure recurred.
• Confirmed no ANTHROPIC_API_KEY or other env var/config is overriding auth.
• Confirmed claude.ai web-based Claude Code access works fine throughout, on the same account.

This strongly suggests an eventually-consistent or flapping entitlement check on the backend for personal Claude Max accounts, rather than any client-side/config issue.

Environment

• Claude Code CLI version: 2.1.236
• OS: macOS (Darwin 25.5.0)

Expected behavior

Claude Code CLI should consistently recognize the active Claude Max subscription and not intermittently reject requests as if subscription access were org-disabled.