← Blog · 2026-10-23

Claude Code Login Not Working? 12 Causes and Fixes

30-second test: run /status inside Claude Code, or claude auth status --text from your shell (it exits 0 when you're logged in, 1 when you're not). If it shows an API key, apiKeyHelper or Auth token source you didn't expect, jump to causes 5, 8 and 12. If it shows no credential at all, start at cause 1.

Claude Code can authenticate with several credentials at once: a claude.ai subscription login, a Claude Console login, an ANTHROPIC_API_KEY, an apiKeyHelper script, a long-lived CLAUDE_CODE_OAUTH_TOKEN or a cloud provider. Most "login not working" problems are either the browser sign-in failing to get back to the terminal, or the login working fine while a different credential quietly wins.

First: which credential is Claude Code using?

When several credentials are present, Claude Code picks one in this order: cloud provider (when CLAUDE_CODE_USE_BEDROCK, CLAUDE_CODE_USE_VERTEX or CLAUDE_CODE_USE_FOUNDRY is set), then ANTHROPIC_AUTH_TOKEN, then ANTHROPIC_API_KEY, then apiKeyHelper, then CLAUDE_CODE_OAUTH_TOKEN, then Anthropic profile and federation credentials, and last the subscription login you made with /login. So your /login is the credential that loses to everything else. /status shows the one in use and, when a login and an API key are both configured, marks the one that isn't. The JSON from claude auth status has an authMethod field: none, claude.ai, oauth_token, api_key, api_key_helper or third_party.

The browser sign-in never completes: causes 1 to 4.
You signed in, but requests fail with 401, 400 or 403: causes 5 to 9.
It keeps asking you to log in again, or works only interactively: causes 10 to 12.

When the cause isn't clear, a clean reset fixes most cases: run /logout, close Claude Code, start claude again and complete the login.

The browser sign-in never completes: 4 causes

The browser didn't open, or the link can't be clicked. Press c at the login prompt to copy the login URL and paste it into a browser yourself. This also works when the URL wraps across lines in a narrow or SSH terminal. claude auth login prints the URL too. When it finishes, the terminal shows Login successful and asks you to press Enter.
You're on WSL2, SSH or in a container. The browser opens on a different machine, so its redirect can't reach Claude Code's local callback server. After you sign in, the browser shows a code instead of redirecting back: paste it into the terminal at the Paste code here if prompted prompt. If no browser opens from WSL2 at all, set BROWSER to your Windows browser, for example export BROWSER="/mnt/c/Program Files/Google/Chrome/Application/chrome.exe". If pasting does nothing, your terminal's paste shortcut isn't reaching the prompt: try right-click or Shift+Insert in Windows Terminal, or run claude auth login, which reads the pasted code from standard input.
"OAuth error: Invalid code. Please make sure the full code was copied". The code expired or was cut off when you copied it. Press Enter to retry and finish quickly after the browser opens. On a remote or SSH session, the browser may have opened on the wrong machine; copy the URL from the terminal and open it in your local browser.
Claude Code can't listen on 127.0.0.1. The sign-in returns through a local port. If a sandbox or security software blocks it, you see The browser can't return the sign-in to Claude Code automatically: just open the URL shown, sign in and paste the code at Paste code here >. If you see Couldn't start the local listener that receives the browser sign-in, run the command again, and if it stops the same way, use a token or API key instead (see cause 12). Piping input into claude auth login causes this too; run it in a real terminal. Before v2.1.305 this failed with Failed to start OAuth callback server, so update.

Signed in, but requests fail: 5 causes

An old ANTHROPIC_API_KEY is overriding your subscription. This is the classic one. API Error: 400 ... "This organization has been disabled" while your subscription is active usually means a key from an old job or project is still exported. Please run /login · API Error: 401 Invalid authentication credentials can be the same thing: if /status shows an API key row that isn't marked as not in use, the key is what's being rejected. In interactive mode Claude Code asks once whether to use the key and remembers your answer; with -p it always uses the key when present. /login doesn't replace an approved key. Fix: unset ANTHROPIC_API_KEY (PowerShell: Remove-Item Env:ANTHROPIC_API_KEY), then remove the export line from ~/.zshrc, ~/.bashrc or ~/.profile (on Windows, your $PROFILE and User environment variables). Run env | grep ANTHROPIC too: direnv, dotenv shell plugins and IDE terminals can load a stale key from a project .env file. The Use custom API key toggle in /config changes your earlier approval while the variable is set.
API Error: 403 Request not allowed after login. For Pro or Max, check that your subscription is active at claude.ai/settings. For Console accounts, your account needs the "Claude Code" or "Developer" role, which an admin assigns on the Console Members page. Behind a corporate proxy, the proxy may be interfering; see Anthropic's network configuration page.
"Claude Code access has not been granted for this account". If the sign-in page shows this after you log in, your Claude Enterprise organization gave you the Custom role and none of your groups' custom roles includes Claude Code. Nothing in Claude Code fixes it: ask an Owner of your organization to grant a role with Claude Code access, then run claude and log in again.
An apiKeyHelper script is failing. If your settings name an apiKeyHelper, its output outranks your saved login for as long as the setting exists, so /login doesn't help. Your apiKeyHelper script is failing appears within three attempts when the command errors, times out, prints nothing or prints something other than the key. Fix: run the command yourself in a shell; it must print only the key to stdout and exit 0. If it reports an expired session, sign in to your SSO or vault again. /status shows an apiKeyHelper row reading Failing with the error output. To find which settings file defines it, our free settings precedence checker shows which file wins.
Your organization restricts the login. An admin can set forceLoginMethod ("claudeai" or "console") and forceLoginOrgUUID in managed settings. Then a login from another organization is reported as an error, the login prompt can reappear even after an earlier sign-in, and with "claudeai" an API key from an earlier Console login doesn't count as signed in (and the reverse with "console"). Environment credentials such as ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN and apiKeyHelper are blocked at startup under these keys. Fix: log in with the account type and organization the policy names, or ask your admin to add you.

It keeps asking you to log in: 3 causes

The login expired. Login expired · Please run /login means Claude Code tried to renew your saved claude.ai login, the refresh was rejected and the credentials were cleared; OAuth token revoked or 401 OAuth token has expired means the API rejected it. Run /login. Claude Code warns three days ahead with Your login expires in 3 days · run /login to renew, and /status shows a Login row reading Expired — log in again. If it happens often, check that your system clock is accurate, since token validation depends on it. Could not refresh your login because another Claude Code process is refreshing it isn't a rejection: wait a minute, close other Claude Code windows, or run /login.
The macOS Keychain won't save the login. Couldn't save your login. If your Mac's keychain is locked, unlock it and log in again. means the login never completed. When the Keychain rejects a write, for example while locked in an SSH session, Claude Code falls back to ~/.claude/.credentials.json. Run claude doctor; a macOS Keychain is not writable warning confirms it. Unlock it with security unlock-keychain ~/Library/Keychains/login.keychain-db, or resync the Keychain password in Keychain Access, then /logout and /login. Logging out removes all stored credentials, including MCP server logins and plugin secrets, so expect to re-enter those.
Scripts, CI and -p runs don't have your login. A -p command or Agent SDK program that relies on a saved login needs you to run claude in that same environment and complete /login first. For automation without a browser, run claude setup-token: it opens the same browser authorization and prints a one-year OAuth token (it doesn't save it). Set it as CLAUDE_CODE_OAUTH_TOKEN wherever the script runs. It needs a Pro, Max, Team or Enterprise plan and can only make model requests. --bare mode doesn't read CLAUDE_CODE_OAUTH_TOKEN, so bare scripts need ANTHROPIC_API_KEY or an apiKeyHelper. And if a 401 keeps coming back while this variable is set, Claude Code keeps sending its value: generate a fresh token, or unset it and run /login.

Two special cases

Work and personal accounts. Give each account its own configuration directory, for example alias claude-work='CLAUDE_CONFIG_DIR=~/.claude-work claude'. Each directory keeps its own settings, history and login, and the first run walks you through login again. Two Console sign-ins without an API key aren't kept apart this way, because that kind of sign-in is stored outside the configuration directory.
Bedrock, Google Cloud's Agent Platform or Microsoft Foundry. No browser login is involved. Could not load credentials from any providers (Bedrock), Could not load the default credentials (Agent Platform) or ChainedTokenCredential authentication failed (Foundry) means the cloud CLI isn't signed in in that shell: check aws sts get-caller-identity, gcloud auth application-default login or az login. If it works in your terminal but not in the VS Code or JetBrains extension, the IDE didn't inherit your shell's environment; see our IDE not connecting guide for the IDE side.

Still stuck?

If the problem is that claude isn't found at all, see Claude Code command not found. Run claude doctor for an automated report, and check /status again after each change. If the problem is the account rather than the install, such as a login loop, a subscription that isn't recognized or a disabled organization, contact Anthropic support from claude.ai (Console users: platform.claude.com) via your initials, then Get help. If a key in your env block or settings file seems to do nothing, settings not applying explains which file each key belongs in.

Facts on this page come from Anthropic's Claude Code docs on authentication, troubleshooting installation and login, errors and the CLI reference. This guide isn't affiliated with Anthropic.