Error text / 报错原文
Not logged in · Please run /loginOAuth token revokedOAuth token has expiredInvalid API key
What it actually means
Claude Code reached an operation that needs a usable credential, but the selected credential is missing, expired, revoked, or unauthorized. A completed browser login does not prove that subscription OAuth is active: Claude Code evaluates higher-priority provider flags and environment credentials first.
Credential precedence: the hidden cause of login loops
According to the official authentication reference, Claude Code checks these sources in order. The first applicable source wins.
| Priority | Credential source | Common failure |
|---|---|---|
| 1 | Bedrock, Vertex AI, or Foundry provider flags | A provider mode remains enabled in the shell |
| 2 | ANTHROPIC_AUTH_TOKEN | An old bearer token shadows every source below it |
| 3 | ANTHROPIC_API_KEY | A revoked or wrong-workspace key overrides OAuth |
| 4 | apiKeyHelper | The helper returns a stale or empty value |
| 5 | CLAUDE_CODE_OAUTH_TOKEN | An automation token expired or was revoked |
| 6 | Subscription OAuth from /login | The browser callback or local token cache failed |
Fast diagnostic path
- Run
claude auth status. Inside Claude Code, also run/statusto see the active auth method and account. - Check whether override variables exist without printing their secret values. An unexpected variable is more informative than another login attempt.
- If subscription OAuth is intended, run
/logout, close Claude Code completely, restart it, and log in again. - For SSH, WSL, or containers where the browser callback cannot return, press
cto copy the login URL, open it locally, and paste the authorization code back into the terminal.
claude auth status
printenv ANTHROPIC_AUTH_TOKEN >/dev/null && echo "ANTHROPIC_AUTH_TOKEN is set"
printenv ANTHROPIC_API_KEY >/dev/null && echo "ANTHROPIC_API_KEY is set"
printenv CLAUDE_CODE_OAUTH_TOKEN >/dev/null && echo "CLAUDE_CODE_OAUTH_TOKEN is set"
Reset only the credential you intend to use
- Claude subscription: remove unintended higher-priority overrides, then use
/logoutand/login. - Anthropic API: replace the invalid environment key; do not expect browser login to override it.
- Bedrock, Vertex AI, or Foundry: verify the provider flag and that provider's native credentials.
- Automation: use
claude setup-tokento generate a long-lived OAuth token, then store it in a secret manager rather than project files.
Where Claude Code stores login credentials
- macOS: the encrypted macOS Keychain.
- Linux:
~/.claude/.credentials.jsonwith mode0600. - Windows:
%USERPROFILE%\.claude\.credentials.json. - Custom config: under the directory set by
CLAUDE_CONFIG_DIR.
Back up settings before manually deleting a credential file. A targeted logout/login is safer than removing the entire Claude configuration directory.
What not to do
- Do not print complete API keys or OAuth tokens into terminal logs, issue reports, or screenshots.
- Do not commit credential files,
.envfiles, or tokens to the repository. - Do not delete all of
~/.claudejust to repair one stale login. - Do not keep retrying
/loginwhile a higher-priority environment credential is still active.
How to confirm the fix
Verify the auth source first, then run a minimal prompt before reopening a long agent session.
claude auth status claude -p "Reply with OK" claude doctor
Related errors
- You've hit your session limit / weekly limit - Claude Code →
- Prompt is too long - Claude Code context window →
- API Error: Repeated 529 Overloaded errors - Claude Code →
- MCP servers failed to connect - Claude Code →
- Failed to exchange authorization code for token - Antigravity →
- Failed to get OAuth token: state syncing error: key not found - Antigravity →
FAQ
Why am I still not logged in after the browser says success?
The terminal callback may not have completed, or a higher-priority environment credential may be selected. Check claude auth status and the precedence table.
Should I use ANTHROPIC_API_KEY with a Claude subscription?
Not for subscription OAuth. If that variable is present, Claude Code can choose it before the /login credential.
Can I log in on a remote server without a browser?
Yes. Copy the authorization URL, complete it in a local browser, then paste the returned code into the remote terminal.