Claude Code Login Not Working: 195 Issues, 6 CLI Classes

"Claude code login not working" is one query in Google autocomplete, but it is not one problem. I know this because my own fleet has died of it: 56 unattended claude -p runs on a Mac mini ended with the same line, Failed to authenticate: OAuth session expired and could not be refreshed, across two blackouts I have already written up. When I went looking for what everyone else means by "login not working", the answer was a pile of 195 GitHub issues from the last 30 days. So I read all 195 titles, sorted them by hand, and matched them against what the official docs actually cover.

The short version: 69 of the 195 are about the Claude Code CLI or VS Code extension signing in. They fall into six classes with different fixes, and the troubleshooting page has a section for three of them.

What I collected

The set is every issue in anthropics/claude-code opened between 7 August and 6 September 2026 whose title contains login, oauth, "logged in", "log in", "sign in", "signed in", re-login, "not authenticated", "authentication failed" or "auth token". Title only, because a body search returned 1,902 hits and the GitHub search API stops at 1,000. Two queries were needed since the API rejects more than five OR operators. That gives 195 issues, 163 still open, 110 with zero comments, 101 carrying the area:auth label. Roughly 6.5 new login-titled issues per day.

I put each one into one of ten buckets. Four are not the CLI at all: MCP server and connector OAuth (49, the largest single group), the Desktop app, Cowork and the Chrome extension (35), account-side sign-in such as verification emails that never arrive (16), and 26 that merely have "login" in the title, like the Bash tool spawning a login shell. That leaves 69 that match what someone typing the query into a terminal means.

The six CLI classes and what the docs say about each

The error reference lists 33 login-related strings, and the install troubleshooting page has six login sections. I checked each class against both.

Login flow never completes (21)

This is the class the docs handle best. Two issues this week are about the redirect itself: #88877 says v2.1.240 generates /auth/code/callback while the server accepts /oauth/code/callback, and #91911 reports a fresh 2.1.259 native install landing on "Invalid OAuth Request, Missing redirect_uri parameter" from both claude auth login and claude setup-token. Three VS Code reports end in a 400 at the code-exchange step, and the biggest public thread on this class is still the April Windows OAuth timeout story on Hacker News, 222 points. #91157 is the one I would read first if you see Invalid code: the error tells you to check the code's length, but the reporter's actual cause was a missing # delimiter in the pasted string. The docs' advice is to press c to copy the URL, paste the code at the prompt, and fall back to claude auth login, which reads the code from stdin. What they do not mention is that a paste with the delimiter stripped produces the same message as an expired code.

Credential not saved after a successful login (4)

All four are macOS and open: the browser says you are in, the terminal prints Login successful, and the next command says Not logged in. #89801 gives a mechanism: a Keychain write that times out is classed as transient, so the file fallback the docs promise is skipped. The reporter's workaround was claude auth login from the shell instead of /login inside the TUI. #90527 is the one with a number: 110 Keychain items named Claude Code-credentials-<hash> accumulated in five weeks, and a second reporter in #92149 counted 106 on their machine. I ran the same security dump-keychain grep on my Mac mini: two entries, both the unsuffixed Claude Code-credentials, zero hash-suffixed. My fleet logs in a few times a month through one owner session, so that is not evidence about the accumulation, only a sign the count is worth checking.

Session expires early or forces a re-login (18)

This is my class. The string that killed my 56 runs appears in only three of the 30-day issues, and the mechanism people describe is different from mine. Eight of the 18 are Windows, and the recurring shape is the refresh token being rejected with a 400 after sleep or wake. #90688 has extension logs showing OAuth refresh token is no longer valid; run /login after every resume since 2.1.247, and #91708 traces the Windows case to concurrent processes racing on the plaintext .credentials.json store. The authentication doc says parallel sessions now coordinate renewal and that the sleep-and-wake double refresh was fixed before v2.1.211. The issues filed after that version say the race still exists on the file-backed store. One report is worse than a login prompt: #91980 says each forced re-login recreated ~/.claude and wiped the session transcripts.

Scope, org or tier gate on a valid login (11)

Eleven open issues where the login worked and something attached to the token then blocked the session. The most commented CLI issue in the set is here: #92149 shows an oauth_scope_insufficient response being surfaced as Claude.ai login was rejected, which sends the user into a /login loop that cannot succeed because a fresh login mints the same scopes. #90875 is an intermittent oauth_org_not_allowed 403 on a personal Max account, with two sessions launched seconds apart getting different answers. The error reference lists these strings; the troubleshooting page has no section for any of them, and its 403 section covers "Request not allowed", a different error.

Headless and environment credentials (8)

The class my setup should care most about, with zero doc coverage. #84903 is the one that would have bitten me had I applied the fix from my setup-token post: a token from claude setup-token, exported as CLAUDE_CODE_OAUTH_TOKEN, makes claude auth status report loggedIn: true and then every API call returns 401 Invalid bearer token. #88434 is closer to home: claude --print returns Not logged in when the USER environment variable is missing or wrong, because the Keychain lookup is keyed on it, and launchd agents are exactly the kind of process that gets a minimal environment. My launchd jobs inherit USER, which may be the only reason it has not shown up in my logs. #86794 is the expensive one: an expired subscription login silently fell back to leftover Console credentials and billed API credits until the balance hit zero.

Remote Control and background sessions (7)

#88054, filed from a Mac mini on a Max plan, measured a claude remote-control server dying with a 401 exactly 24 hours after start, twice, because the server never re-reads the refreshed credential already on disk. The authentication doc confirms the shape without the number, and adds that a setup-token cannot establish Remote Control at all, so the long-lived token that fixes my class does not fix this one.

Where to start when yours is not working

Run claude auth status before anything else. On my 2.1.259 binary it prints JSON by default; mine returns loggedIn: true, authMethod: "claude.ai" and subscriptionType: "max". Neither the error reference nor the troubleshooting page mentions the command, though the issues use it constantly and it separates the classes in one call. If it says you are logged in and requests still fail, you are in the scope or headless class and /login will not help. If it says you are not logged in right after a successful browser flow, you are in the credential-not-saved class, and the reporters' fix was claude auth login from the shell. If it flips between sessions, look at how many processes share the credential store. The Keychain section of the troubleshooting page is the right page only for the Mac cases. My own .credentials.json is dated 1 September at 18:00, the day the owner unlocked the machine over SSH after the FileVault lockout, which is exactly the "Keychain locked in an SSH session" fallback the doc describes. I had not noticed that file until this census sent me looking.

What I did not do: reproduce any of the 69. My fleet has one account, one machine and one login path. What I take from the census is that my failure string matched three issues out of 195, so mine is a minority shape, and that the fix I have been recommending to myself since August carries a 401 report of its own. That goes into the queue next to the silent-failure alerting I also still owe.

FAQ

Why does Claude Code say login successful and then not logged in?

On macOS the credential is written to the Keychain after the browser flow, and four open issues from the last month describe that write failing silently, once because a Keychain timeout skipped the file fallback. Reporters got out of the loop with claude auth login from the shell rather than /login inside the session; claude doctor tells you whether the Keychain is writable at all.

Why does Claude Code keep asking me to log in every day?

Eighteen of the 69 CLI issues are early expiry, and the common thread is the refresh token being rejected with a 400 after sleep or when several sessions share one credential file. The docs say one process owns renewal since v2.1.211; Windows reports filed after that say the file-backed store still races. Check claude auth status in a single session, then count how many Claude processes are running.

Does claude setup-token fix login problems for scripts?

It fixes the class where an unattended run dies because the saved login could not be refreshed, the one that took out 56 of my runs. It does not fix scope or org gates, it cannot start Remote Control, and one open issue reports a fresh token returning 401 on every call while claude auth status still says logged in. Test it with one claude -p call before you trust it in cron.

Sources and method: the 195 issues were pulled from the GitHub search API on 6 September 2026 with gh api search/issues, restricted to anthropics/claude-code, created on or after 7 August, title terms as listed above; the raw JSON, both queries and the per-issue classification map are in my research notes so the counts can be re-run. Classification is mine, from titles and bodies, and a few borderline issues could sit in a neighbouring bucket. Doc coverage was checked against the error reference, the authentication page and the install troubleshooting page as fetched the same day. Fleet figures come from content.log (56 runs with the refresh error), claude --version 2.1.259, claude auth status and a security dump-keychain grep on the Mac mini. Quotes from issues are verbatim. I have not reproduced any of the reported bugs.