claude auth login` / `claude setup-token` fail with OAuth 403 "missing user:profile scope" on Windows, while Claude Desktop login works fine

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Claude Code CLI's OAuth login (claude auth login / claude setup-token / /login) fails with a 403 error and "missing user:profile scope", even though the browser authorization step completes successfully. Claude Desktop app on the same machine/account logs in fine, so the account itself works — the issue seems specific to the CLI's OAuth token exchange.

Full diagnostic details, steps to reproduce, and what I've already ruled out are below.

What Should Happen?

claude auth login / claude setup-token should successfully exchange the OAuth authorization for a token with the full required scopes (including user:profile), so that claude auth status reports loggedIn: true and Claude Code can be used with my Pro/Max subscription — consistent with how Claude Desktop already authenticates successfully with the same account on the same machine.

Error Messages/Logs

$ claude setup-token
You already have authentication configured via environment variable or API key helper
(request failed with) 403

$ claude
> /login
> Select: Claude account with subscription
Login
OAuth error: Request failed with status code 403

$ claude doctor
Remote Control
Remote Control requires a claude.ai subscription. Run claude auth login to sign in with your claude.ai account.
- Not signed in to claude.ai
- claude.ai subscription auth not active
- Sign-in is missing the user:profile scope

No installation issues found.

Steps to Reproduce

1. On Windows 11, install Claude Code CLI via `npm install -g @anthropic-ai/claude-code` (version 2.1.215).
2. Run `claude auth login` in PowerShell.
3. Browser opens the OAuth consent page; complete authorization — browser shows "authorization successful".
4. Back in the terminal, run `claude auth status` → reports `loggedIn: false`.
5. Run `claude setup-token` → fails with "You already have authentication configured via environment variable or API key helper", then HTTP 403.
6. Confirmed no ANTHROPIC_AUTH_TOKEN / ANTHROPIC_API_KEY / ANTHROPIC_BASE_URL / apiKeyHelper / CLAUDE_CODE_USE_BEDROCK / CLAUDE_CODE_USE_VERTEX set anywhere (process, user, machine env, settings.json, managed-settings.json) — error persists regardless.
7. Run `claude` → `/login` → select "Claude account with subscription" → immediately fails with `OAuth error: Request failed with status code 403`.
8. Run `claude doctor` → confirms "Not signed in", "Sign-in is missing the user:profile scope".
9. Claude Desktop app, installed on the same machine under the same account, logs in via OAuth successfully with no issues.

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.215

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

Title

claude auth login / claude setup-token fail with OAuth 403 "missing user:profile scope" on Windows, while Claude Desktop login works fine

Environment

• OS: Windows 11 Home (10.0.26200), x64
• Claude Code CLI version: 2.1.215 (npm-global install, @anthropic-ai/claude-code)
• Install path: %APPDATA%\npm\node_modules\@anthropic-ai\claude-code\bin\claude.exe
• Node.js via npm global wrapper (claude.ps1 / claude.cmd) — verified unmodified, standard npm-generated wrapper
• Claude Desktop app: installed and logged in successfully on the same machine/account

Steps to reproduce

1. Run claude auth login in PowerShell
2. Browser opens, OAuth consent page completes, browser shows "authorization successful"
3. Back in terminal, claude auth status still reports loggedIn: false
4. Run claude setup-token:

• First attempt: error "You already have authentication configured via environment variable or API key helper", followed by HTTP 403

1. Run claude → /login interactively, select "Claude account with subscription":

• Fails immediately with: OAuth error: Request failed with status code 403

claude doctor output (relevant section)

Remote Control
Remote Control requires a claude.ai subscription. Run claude auth login to sign in with your claude.ai account.
- Not signed in to claude.ai
- claude.ai subscription auth not active
- Sign-in is missing the user:profile scope

No installation issues found.

What I've already ruled out locally

• ANTHROPIC_AUTH_TOKEN, ANTHROPIC_API_KEY, ANTHROPIC_BASE_URL, ANTHROPIC_MODEL, CLAUDE_CODE_USE_BEDROCK, CLAUDE_CODE_USE_VERTEX — confirmed unset at process, user (HKCU\Environment), and machine (HKLM\...\Environment) scope
• No ~/.claude/settings.json, ~/.claude/settings.local.json, or project-level .claude/settings.json exist (so no apiKeyHelper)
• No enterprise managed policy file at C:\ProgramData\ClaudeCode\managed-settings.json
• claude.ps1 / claude.cmd wrapper scripts are unmodified npm-generated boilerplate (no injected env vars)
• No Windows hosts file entries for anthropic.com / claude.ai domains
• No stray credentials in Windows Credential Manager (cmdkey /list) related to claude/anthropic
• System clock/timezone correct (China Standard Time, verified against actual time)
• curl -v to https://console.anthropic.com and https://api.anthropic.com both complete TLS handshake normally with expected HTTP responses (301 redirect and 403-for-unauthenticated-GET respectively) — no certificate interception detected
• Tested through a home-network local HTTP/SOCKS proxy (residential IP, same egress as a mobile device on the same network) — same 403 result regardless

Additional notes

• Claude Desktop app on the same machine/account is already logged in via OAuth and works normally, suggesting the account itself can authenticate somewhere, but the standalone CLI's OAuth flow specifically cannot obtain a token with the user:profile scope.
• I have not yet tested from a completely different network/IP (in progress).

Request

Could you help identify why the CLI-specific OAuth flow returns 403 / is missing the user:profile scope, while Desktop login for the same account succeeds? Is this likely account-side rate limiting/anti-abuse, or a client-side OAuth scope negotiation issue in 2.1.215? Happy to provide additional logs if needed (redacting secrets).