[BUG] VSCode extension shows "OAuth session expired and could not be refreshed" despite a valid, non-expired Keychain credential

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Environment

• Claude Code CLI version: 2.1.207
• VSCode version: <fill in via Code > About Visual Studio Code>
• Claude Code extension version: <fill in via Extensions panel>
• OS: macOS 14.3 (Build 23D2057)
• Not using SSH/remote — local session

Description

After completing the OAuth browser login flow (confirmed success at the
platform.claude.com/oauth/code/success?app=claude-code page), the Claude
Code VSCode extension immediately shows:

Failed to authenticate: OAuth session expired and could not be refreshed

This persists even after repeated /logout + /login cycles, and even
after fully quitting and reopening VSCode.

What I've ruled out

• No conflicting env vars (ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN,

CLAUDE_CODE_OAUTH_TOKEN all unset)

• No local ~/.claude/.credentials.json fallback file present
• System clock is correct (no skew)
• No proxy configured; console.anthropic.com and api.anthropic.com

are reachable

• The macOS Keychain entry "Claude Code-credentials" exists, is updated

on each login, and contains a valid, non-expired token:

• accessToken expires ~8 hours in the future at time of testing
• refreshToken expires ~4 weeks in the future at time of testing
• Running the plain CLI directly in a terminal (claude -p "reply with

just: ok") works correctly and authenticates successfully using
the same Keychain entry.

Conclusion

The credential itself is valid and the CLI can use it fine. The bug
appears isolated to the VSCode extension's auth-check/refresh path,
which is either reading a different/stale credential source than the
CLI, or misinterpreting the valid token as expired.

Steps to reproduce

1. Install/open Claude Code extension in VSCode on macOS (not

SSH/remote)

1. Complete /login OAuth flow successfully in browser
2. Extension immediately reports "OAuth session expired and could

not be refreshed"

1. Confirm via claude -p "..." in a plain terminal that the same

Keychain credential authenticates successfully outside the extension

Expected behavior

Extension should authenticate successfully using the same valid
credential the CLI uses.

What Should Happen?

Extension should authenticate successfully using the same valid credential the CLI uses. Since claude -p "..." in a plain terminal authenticates fine with the same Keychain entry, the VSCode extension should succeed too instead of reporting the session as expired.

Error Messages/Logs

Extension should authenticate successfully using the same valid credential the CLI uses. Since `claude -p "..."` in a plain terminal authenticates fine with the same Keychain entry, the VSCode extension should succeed too instead of reporting the session as expired.

Steps to Reproduce

1. Install/open Claude Code extension in VSCode on macOS (not SSH/remote)
2. Complete /login OAuth flow successfully in browser (browser shows "Build something great / You're all set up for Claude Code")
3. Extension immediately reports: "Failed to authenticate: OAuth session expired and could not be refreshed"
4. Repeat /logout + /login — same error persists
5. Fully quit and reopen VSCode — same error persists
6. Update Claude Code to latest version (2.1.268) and retry — same error persists
7. Confirm via claude -p "reply with just: ok" in a plain terminal that the same Keychain credential ("Claude Code-credentials" entry) authenticates successfully outside the extension

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.268

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_