Claude Code “Login expired” or “Failed to refresh OAuth token”? What each error means and how to fix it

Almost every Claude Code login error, from “Login expired · Please run /login” to “API Error: 401 OAuth token has expired”, is fixed by typing /login and signing in again, according to Anthropic’s Claude Code error reference. The one exception is the long message that starts “Failed to refresh OAuth token: another Claude Code process is refreshing it”: that one usually clears by itself if you wait a minute. Here’s what each message means, why Claude Code keeps logging you out, and what to do when /login doesn’t stick.

Last checked: October 12, 2026, against Claude Code 2.1.296 and Anthropic’s documentation.

Claude Code login errors: which one have you got?

Claude Code signs you in with an OAuth token, a saved login that it renews in the background. When that renewal goes wrong you get one of several messages that look alike but mean different things:

Messages as worded in Anthropic’s Claude Code error reference, October 2026. In the Claude Desktop app’s Code tab and Cowork, “Not logged in” reads “Authentication required · Sign in again to continue”.

None of these depend on your country or plan: they appear the same way on Pro, Max, Team and Enterprise wherever Claude is available. If you can’t sign in at all and the message mentions your organisation instead, see our guide to “Your organization has disabled Claude subscription access”.

“Failed to refresh OAuth token: another Claude Code process is refreshing it”

This is the error people paste into Google most, and it’s the least serious. Anthropic says it “doesn’t mean your login was rejected.” Your saved login had expired and needed renewing, and every Claude Code session on the same computer shares that one login. To stop two sessions renewing it at once, Claude Code uses a lock: one process takes it, renews the login, and the others pick up the result.

You see this message when another process held the lock, or quit and left it behind, and nothing happened while your session waited. In the terminal it reads:

Could not refresh your login because another Claude Code process is refreshing it (or exited mid-refresh) · Try again in a minute; if it keeps happening, close other Claude Code windows or sign in again with /login

In claude -p and the Agent SDK it’s the longer “Failed to refresh OAuth token” version, with the error code server_error. Anthropic’s fix, in order:

1. Wait a minute and try again. If the other process finishes renewing, your session uses the new login automatically.
2. Close other Claude Code windows and processes, including background sessions and any terminal tabs you forgot about, then retry.
3. Run /login if it still happens with nothing else running. Signing in again doesn’t wait for the lock.
4. Update Claude Code with claude update. The changelog lists fixes for this exact error in version 2.1.282, where requests failed “for up to a minute” after the other process was closed or killed, and in 2.1.285, for two sessions recovering a lock left by a crashed process at the same time.

If you run several Claude Code sessions side by side, for example with agent view, this is the error you’re most likely to hit. It only affects sessions signed in with /login: anything using an API key, CLAUDE_CODE_OAUTH_TOKEN or a cloud provider never sees it.

“Login expired · Please run /login” in Claude Code

This one means Claude Code tried to renew your claude.ai login, the sign-in service turned it down, and Claude Code deleted the saved credentials. From then on every request stops on your computer before it’s sent, because, as Anthropic puts it, “only /login can create new credentials.” Retrying without signing in gives the same message every time.

The fix is /login. If you have another Claude Code window open and sign in there, sessions sharing the same configuration folder pick up the new login on their own, with no restart needed (on macOS this needs version 2.1.286 or later; older versions have to be restarted).

You can spot the problem before it bites: /status shows a Login row reading “Expired, log in again”, along with the organisation and email of the old login, from version 2.1.210. If your account has been suspended rather than simply logged out, you get “Your account is on hold” instead.

“API Error: 401 OAuth token has expired” or “OAuth token revoked”

These come from Anthropic’s servers rather than from Claude Code itself. An expired token means the background renewal failed partway through a session; a revoked one means you signed out everywhere or an admin took away your access. Both are fixed with /login.

The trickier one is API Error: 401 Invalid authentication credentials. Anthropic says this isn’t an expired token at all: the credential was recently revoked, or the organisation or account behind it was disabled. Run /status first to see what Claude Code is actually using:

• An API key row: an ANTHROPIC_API_KEY you approved is taking priority over your login, so /login won’t help. Rotate the key in the Claude Console, or remove it with unset ANTHROPIC_API_KEY (in PowerShell, Remove-Item Env:ANTHROPIC_API_KEY).
• Only your login: run /login once. If the same error comes back for the same account, the account or organisation is no longer active and your admin has to restore it.
• A gateway: if ANTHROPIC_BASE_URL points at a company LLM gateway, the 401 is the gateway’s message, and only fixing the credential it expects will clear it.

“Your login expires in 3 days · run /login to renew”

This is a warning, not an error. Claude Code shows it at startup when your login is within three days of expiring, and Anthropic says it “never blocks a request”: everything keeps working until the login actually runs out. Run /login whenever it suits you to reset the clock.

It’s worth doing before you leave anything running unattended. A background session or a Remote Control session that outlives your login stops making progress when it expires, and can’t recover until you sign in again. The warning only appears when you’re signed in with a claude.ai account, not with an API key or a cloud provider.

Why does Claude Code keep asking me to log in?

If /login works but you’re asked again a day later, or every time you open a new window, Anthropic’s login troubleshooting page points to a handful of causes:

• Your clock is wrong. Token checks depend on accurate timestamps, so set your computer’s date and time to update automatically.
• Waking from sleep, on old versions. Before version 2.1.211, two sessions could renew with the same token after the machine woke up, which revoked the saved login and logged every open session out at once. Update Claude Code.
• A locked macOS Keychain. Claude Code keeps your login in the login Keychain. If it’s locked, for example over SSH, or its password is out of sync with your Mac password, Claude Code falls back to a plain-text file at ~/.claude/.credentials.json. Run claude doctor; if it warns that “macOS Keychain is not writable”, unlock it with security unlock-keychain ~/Library/Keychains/login.keychain-db, or resync the password in Keychain Access, then run /logout and /login. Logging out also clears saved MCP server logins, so expect to reconnect those.
• WSL2, SSH or a container. The browser opens on a different machine and can’t hand the login back. After signing in, paste the code the browser shows into the terminal’s “Paste code here if prompted” box, or use claude auth login, which reads the code from standard input.
• “OAuth error: Invalid code”. The code expired or was cut off when you copied it. Press Enter to retry and finish quickly, or press c to copy the full sign-in link.

When nothing else works, Anthropic’s clean reset is: /logout, close Claude Code, start it again with claude and sign in from scratch.

Claude Code OAuth token for scripts, CI and claude -p

Scripts can’t open a browser, so a saved login that expires mid-pipeline is a common cause of “Failed to authenticate” errors in claude -p and the Agent SDK. For a quick fix, run claude in the same environment, complete /login, then rerun the command.

For anything that runs unattended, Anthropic recommends a long-lived token instead. Run claude setup-token, approve access in the browser, and it prints a one-year OAuth token. It isn’t saved anywhere, so copy it and set it as CLAUDE_CODE_OAUTH_TOKEN where the script runs:

export CLAUDE_CODE_OAUTH_TOKEN=your-token

A few things to know, from Anthropic’s authentication guide:

• It needs a Pro, Max, Team or Enterprise plan, and it can only make model requests: no Remote Control and no claude.ai connectors, though MCP servers you set up locally still work.
• When it expires or is revoked you get the same 401 messages as above, and Claude Code keeps sending it rather than switching to your saved login. Generate a new one, or unset the variable and use /login.
• --bare mode doesn’t read it: use ANTHROPIC_API_KEY there.
• An API key ranks above it. If both are set, Claude Code uses the key, which is billed per token on top of your plan.

If you run Claude Code in the cloud rather than on your own machine, our guide to cloud session pricing covers how those sessions are billed.

“Remote Control disconnected”: OAuth token refresh failed

Remote Control, which lets you steer a Claude Code session on your computer from claude.ai or your phone, runs on short-lived credentials renewed from your saved login. When that renewal fails, Claude Code drops the Remote Control link but keeps your local session running, and shows a line starting “Remote Control disconnected” followed by the reason: “Claude.ai login expired”, “Claude.ai login was rejected”, “OAuth token unavailable”, “OAuth token refresh failed”, “JWT refresh failed: no OAuth token” or “Signed out of Claude”.

All of them have the same fix: run /login, then /remote-control to reconnect. Messages that end “run /login to restore Remote Control” reconnect by themselves once you’ve signed in. If the login service simply doesn’t answer, rather than rejecting you, Claude Code keeps retrying while its current credential lasts, so a brief blip doesn’t cut you off. A wider sign-in failure is worth checking at status.claude.com: login was one of the first things to break in the September 29 outage.

Frequently asked questions

What does “failed to refresh OAuth token: another Claude Code process is refreshing it” mean?

Your saved Claude Code login needed renewing, and another Claude Code process on the same computer was renewing it, or crashed while doing so. Anthropic says it doesn’t mean your login was rejected. Wait a minute and try again, close other Claude Code windows if it keeps happening, and run /login if it persists with nothing else running.

How do I fix “Login expired · Please run /login” in Claude Code?

Type /login and sign in again. Claude Code has already deleted the expired login, so retrying without signing in shows the same message on every request.

How do I fix “API Error: 401 OAuth token has expired”?

Run /login. The message means Claude Code’s automatic renewal of your login failed partway through a session. If you use a CLAUDE_CODE_OAUTH_TOKEN variable, generate a new token with claude setup-token instead.

Why does Claude Code keep logging me out?

The usual causes are a wrong system clock, a locked or out-of-sync macOS Keychain, an old version of Claude Code that logged every session out after the computer woke from sleep (fixed in 2.1.211), or running in WSL2, SSH or a container where the browser can’t hand the login back. Update Claude Code and run claude doctor to check.

How long does a Claude Code login last?

Anthropic doesn’t publish an exact length for /login sessions, but Claude Code warns you at startup when your login is within three days of expiring. A token made with claude setup-token lasts one year.

What does “Your login expires in 3 days” mean in Claude Code?

It’s a warning that your saved login will run out soon. It doesn’t block anything, and running /login renews it. Renew before leaving background or Remote Control sessions running unattended.

How do I get a Claude Code OAuth token for CI?

Run claude setup-token, approve access in your browser and copy the one-year token it prints. Set it as the CLAUDE_CODE_OAUTH_TOKEN environment variable where your script runs. It needs a Pro, Max, Team or Enterprise plan and can only make model requests.

What is the difference between “OAuth token has expired” and “Invalid authentication credentials”?

An expired token is a login that failed to renew, fixed with /login. “401 Invalid authentication credentials” means the credential was revoked or the account or organisation behind it was disabled. Check /status: if an API key is active, rotate or remove it; if the same login keeps failing, ask your admin.

Do I need to log out before running /login?

No. /login replaces the saved credentials, including for the “does not meet scope requirement user:profile” error. Anthropic suggests a full /logout, restart and sign-in only when login keeps failing and the cause isn’t clear.

Sources: Anthropic’s Claude Code documentation (error reference, troubleshoot installation and login, authentication), Claude Code changelog.