When Claude Code login isn't working, start with a clean reset: run /logout, close Claude Code, start claude again and complete the browser sign-in. If the browser doesn't open or can't return to the terminal, press c to copy the login URL, open it yourself, and paste the code the browser shows. Most remaining failures come from a stray ANTHROPIC_API_KEY, an expired token, a plan without Claude Code, or a network that blocks the sign-in hosts.
This guide lists each documented error and its fix, based on Anthropic's troubleshoot installation and login page, the authentication docs and the error reference, read on 26 October 2026. For non-login problems, see the broader Claude Code troubleshooting guide.
How is Claude Code login supposed to work?
On first launch, claude opens a browser window where you sign in. When it finishes, the terminal shows Login successful and asks you to press Enter. You can authenticate with:
- A Claude Pro or Max subscription, using your claude.ai account
- A Claude for Teams or Enterprise account your admin invited
- A Claude Console account, again after an admin invite for organizations
- A cloud provider such as Amazon Bedrock, configured with environment variables, with no browser login
The setup docs are explicit that "The free claude.ai plan does not include Claude Code access." If you only have a free account, login problems are really a plan problem.
Useful commands while debugging:
| Command | What it does |
|---|---|
/login |
Sign in, or switch accounts, inside a session |
/logout |
Sign out and reset first-launch setup |
/status |
Show the active account, login method and connectivity |
claude auth login |
Sign in from the shell; --console for Console billing, --sso to force SSO |
claude auth status |
Print auth status as JSON; exits 0 if logged in, 1 if not |
claude doctor |
Read-only install and settings diagnostics, including Keychain access |
How do you reset a broken Claude Code login?
The troubleshooting page says "a clean re-authentication resolves most cases":
- Run
/logoutto sign out completely. - Close Claude Code.
- Run
claudeand complete the sign-in again.
If the browser doesn't open, press c to copy the OAuth URL and paste it into a browser. That also helps when the URL wraps across lines in a narrow terminal and can't be clicked.
Logging out removes all stored credentials, including saved MCP server logins and plugin secrets, so expect to re-authorize those afterwards.
What do the common Claude Code login errors mean?
| Error | Cause | Fix |
|---|---|---|
OAuth error: Invalid code. Please make sure the full code was copied |
The code expired or was cut off during paste | Press Enter to retry and finish quickly; copy the full URL with c; on SSH, open the URL in your local browser |
API Error: 403 Request not allowed |
Inactive plan, missing Console role, or a proxy interfering | Check your subscription at claude.ai/settings; Console users need the "Claude Code" or "Developer" role; see the proxy settings guide |
Claude Code access has not been granted for this account |
Your Enterprise role is Custom and none of your custom roles grant Claude Code | Ask an organization Owner to grant access, then log in again |
This organization has been disabled |
A stale ANTHROPIC_API_KEY is overriding your subscription |
unset ANTHROPIC_API_KEY, remove it from your shell profile, relaunch |
Not logged in · Please run /login |
No valid credential for this session | Run /login, or check the variable you expected is exported |
Login expired · Please run /login |
The saved login couldn't be renewed and was cleared | Run /login |
OAuth token revoked · Please run /login |
You signed out everywhere or an admin removed access | Run /login |
Please run /login · API Error: 401 Invalid authentication credentials |
The account, organization or key behind the credential is no longer active | Check /status; if an API key is active, rotate or unset it; otherwise log in once and ask your admin if it repeats |
Invalid API key · Fix external API key |
The key in ANTHROPIC_API_KEY or apiKeyHelper was rejected |
Check the key in the Console, look for a stale .env, or unset it and use /login |
Your organization has disabled Claude subscription access for Claude Code |
A server-side organization setting | Ask your admin, or use a Console API key |
The 401 Invalid authentication credentials entry deserves a note. The error reference says an approved API key "takes precedence over your login, so /login doesn't replace it." Running /login repeatedly won't help until you remove the key. The API key guide explains the full precedence order.
Why does login fail over SSH, in WSL2 or in a container?
In these setups the browser usually runs on a different machine and its redirect can't reach Claude Code's local callback server. That's expected, and the flow has a fallback: after you sign in, the browser shows a login code, and you paste it at the Paste code here if prompted prompt.
Steps that help:
- Copy the URL yourself. Press
cat the login prompt, or copy the URL thatclaude auth loginprints, and open it in your local browser. - Point WSL2 at a Windows browser. If no browser opens at all, set
BROWSER:
export BROWSER="/mnt/c/Program Files/Google/Chrome/Application/chrome.exe"
claude
- Use
claude auth loginwhen paste doesn't work. If pasting into the interactive prompt does nothing, your terminal's paste shortcut may not reach the input. Try the alternate shortcut, often right-click or Shift+Insert in Windows Terminal, or runclaude auth login, which reads the pasted code from standard input. This also applies on native Windows.
If you see Couldn't start the local listener that receives the browser sign-in. Try again., Claude Code couldn't open a port on 127.0.0.1. Run the command again; if it stops the same way, sign in with a token or API key instead, as described in the next section. Piping input into claude auth login also causes it, so run that command in a terminal where you can paste the code. If Claude Code runs inside a sandbox, check that its policy allows listening on local ports.
How do you log in on a headless server or in CI?
Interactive browser login isn't practical for servers and pipelines. The authentication docs offer two routes:
- Subscription users: run
claude setup-tokenon a machine with a browser. It opens the same authorization flow as/loginand prints a one-year OAuth token without saving it. Set it where you need it:
export CLAUDE_CODE_OAUTH_TOKEN=your-token
It requires a Pro, Max, Team or Enterprise plan and can only make model requests, so it can't start Remote Control sessions or fetch claude.ai connectors.
- Console users: set
ANTHROPIC_API_KEYto a key from the Claude Console, or configure anapiKeyHelperscript.
If your script passes --bare, note that bare mode doesn't read CLAUDE_CODE_OAUTH_TOKEN; use ANTHROPIC_API_KEY or apiKeyHelper there. The headless guide covers claude -p in more depth.
Why does Claude Code keep asking you to log in?
A few documented causes:
- The login expired. When your login is within three days of expiring, Claude Code warns at startup:
Your login expires in 3 days · run /login to renew./statusalso shows aLoginrow when the saved login has expired. - Your system clock is wrong. The docs say to check it, "as token validation depends on correct timestamps."
- An admin policy requires a specific account. If managed settings set
forceLoginOrgUUIDorforceLoginMethod, the login prompt appears until you sign in with an account that matches. - You're on an old version. Before v2.1.290, the login prompt appeared during setup whether or not you were signed in. Update Claude Code to fix it.
macOS Keychain problems
On macOS, Claude Code stores credentials in the login Keychain. When the Keychain rejects the write, for example because it's locked in an SSH session, Claude Code falls back to ~/.claude/.credentials.json. You may also see Couldn't save your login. If your Mac's keychain is locked, unlock it and log in again.
The documented recovery:
- Run
claude doctor. A warning starting withmacOS Keychain is not writableconfirms the problem. - Unlock it with
security unlock-keychain ~/Library/Keychains/login.keychain-db. - If that doesn't help, open Keychain Access, select the
loginkeychain, and use Edit > Change Password for Keychain "login" to resync it with your account password. - Run
/logoutand then/loginto store the login back in the Keychain.
Could a network problem be blocking login?
Yes. Sign-in needs claude.ai, claude.com and platform.claude.com, and organizations using SSO also need sso.claude.com, according to the network access requirements. During first-run setup, Claude Code checks it can reach api.anthropic.com and platform.claude.com and exits with Unable to connect to Anthropic services if not.
Behind a TLS-inspecting proxy, login can fail with SSL certificate error (UNABLE_TO_GET_ISSUER_CERT_LOCALLY). Set NODE_EXTRA_CA_CERTS to your CA bundle. The proxy settings guide walks through both fixes.
How do you use two Claude accounts?
To stay signed in to a work and a personal account at once, give each its own configuration directory with CLAUDE_CONFIG_DIR:
alias claude-work='CLAUDE_CONFIG_DIR=~/.claude-work claude'
The first time you run claude-work, Claude Code walks you through login for that directory. Each directory keeps its own settings, history and login.
What if login still doesn't work?
For account problems, such as a login loop, a subscription that isn't recognized, or a disabled organization, the docs recommend contacting Anthropic support: sign in at claude.ai (Console users: platform.claude.com), click your initials in the lower left, and select Get help. For bugs, check the Claude Code GitHub repository for known issues, as the troubleshooting docs suggest, or run /feedback if you can start a session.
When you find the fix that works on your setup, write it down. Kipt keeps prompts as Markdown in a private GitHub repo you own, so a short "Claude Code login checklist" is easy to pull up with Cmd+K on the next machine.