Home/Wiki Errors/Claude Code
Claude Code / OAuth/Auth

Claude Code “Not logged in — run /login”

Identify the credential Claude Code is actually selecting before you reset anything. An environment API key or provider flag can override a successful subscription login.

Claude Code login loopClaude Code OAuth token revokedClaude Code invalid API key
Paste an error to match it against the wiki. / 粘贴报错后自动匹配。

Error text / 报错原文

  • Not logged in · Please run /login
  • OAuth token revoked
  • OAuth token has expired
  • Invalid API key

What it actually means

Claude Code reached an operation that needs a usable credential, but the selected credential is missing, expired, revoked, or unauthorized. A completed browser login does not prove that subscription OAuth is active: Claude Code evaluates higher-priority provider flags and environment credentials first.

Credential precedence: the hidden cause of login loops

According to the official authentication reference, Claude Code checks these sources in order. The first applicable source wins.

PriorityCredential sourceCommon failure
1Bedrock, Vertex AI, or Foundry provider flagsA provider mode remains enabled in the shell
2ANTHROPIC_AUTH_TOKENAn old bearer token shadows every source below it
3ANTHROPIC_API_KEYA revoked or wrong-workspace key overrides OAuth
4apiKeyHelperThe helper returns a stale or empty value
5CLAUDE_CODE_OAUTH_TOKENAn automation token expired or was revoked
6Subscription OAuth from /loginThe browser callback or local token cache failed

Fast diagnostic path

  1. Run claude auth status. Inside Claude Code, also run /status to see the active auth method and account.
  2. Check whether override variables exist without printing their secret values. An unexpected variable is more informative than another login attempt.
  3. If subscription OAuth is intended, run /logout, close Claude Code completely, restart it, and log in again.
  4. For SSH, WSL, or containers where the browser callback cannot return, press c to copy the login URL, open it locally, and paste the authorization code back into the terminal.
claude auth status
printenv ANTHROPIC_AUTH_TOKEN >/dev/null && echo "ANTHROPIC_AUTH_TOKEN is set"
printenv ANTHROPIC_API_KEY >/dev/null && echo "ANTHROPIC_API_KEY is set"
printenv CLAUDE_CODE_OAUTH_TOKEN >/dev/null && echo "CLAUDE_CODE_OAUTH_TOKEN is set"

Reset only the credential you intend to use

  • Claude subscription: remove unintended higher-priority overrides, then use /logout and /login.
  • Anthropic API: replace the invalid environment key; do not expect browser login to override it.
  • Bedrock, Vertex AI, or Foundry: verify the provider flag and that provider's native credentials.
  • Automation: use claude setup-token to generate a long-lived OAuth token, then store it in a secret manager rather than project files.

Where Claude Code stores login credentials

  • macOS: the encrypted macOS Keychain.
  • Linux: ~/.claude/.credentials.json with mode 0600.
  • Windows: %USERPROFILE%\.claude\.credentials.json.
  • Custom config: under the directory set by CLAUDE_CONFIG_DIR.

Back up settings before manually deleting a credential file. A targeted logout/login is safer than removing the entire Claude configuration directory.

What not to do

  • Do not print complete API keys or OAuth tokens into terminal logs, issue reports, or screenshots.
  • Do not commit credential files, .env files, or tokens to the repository.
  • Do not delete all of ~/.claude just to repair one stale login.
  • Do not keep retrying /login while a higher-priority environment credential is still active.

How to confirm the fix

Verify the auth source first, then run a minimal prompt before reopening a long agent session.

claude auth status
claude -p "Reply with OK"
claude doctor

Related errors

FAQ

Why am I still not logged in after the browser says success?

The terminal callback may not have completed, or a higher-priority environment credential may be selected. Check claude auth status and the precedence table.

Should I use ANTHROPIC_API_KEY with a Claude subscription?

Not for subscription OAuth. If that variable is present, Claude Code can choose it before the /login credential.

Can I log in on a remote server without a browser?

Yes. Copy the authorization URL, complete it in a local browser, then paste the returned code into the remote terminal.

Related tools and guides

Official sources