# Claude Code Login Not Working? 12 Causes and Fixes

> **30-second test:** run `/status` inside Claude Code, or `claude auth status --text` from your shell (it exits 0 when you're logged in, 1 when you're not). If it shows an `API key`, `apiKeyHelper` or `Auth token` source you didn't expect, jump to causes 5, 8 and 12. If it shows no credential at all, start at cause 1.

Claude Code can authenticate with several credentials at once: a claude.ai subscription login, a Claude Console login, an `ANTHROPIC_API_KEY`, an `apiKeyHelper` script, a long-lived `CLAUDE_CODE_OAUTH_TOKEN` or a cloud provider. Most "login not working" problems are either the browser sign-in failing to get back to the terminal, or the login working fine while a different credential quietly wins.

## First: which credential is Claude Code using?

When several credentials are present, Claude Code picks one in this order: cloud provider (when `CLAUDE_CODE_USE_BEDROCK`, `CLAUDE_CODE_USE_VERTEX` or `CLAUDE_CODE_USE_FOUNDRY` is set), then `ANTHROPIC_AUTH_TOKEN`, then `ANTHROPIC_API_KEY`, then `apiKeyHelper`, then `CLAUDE_CODE_OAUTH_TOKEN`, then Anthropic profile and federation credentials, and last the subscription login you made with `/login`. So your `/login` is the credential that loses to everything else. `/status` shows the one in use and, when a login and an API key are both configured, marks the one that isn't. The JSON from `claude auth status` has an `authMethod` field: `none`, `claude.ai`, `oauth_token`, `api_key`, `api_key_helper` or `third_party`.

- The browser sign-in never completes: causes 1 to 4.
- You signed in, but requests fail with 401, 400 or 403: causes 5 to 9.
- It keeps asking you to log in again, or works only interactively: causes 10 to 12.

When the cause isn't clear, a clean reset fixes most cases: run `/logout`, close Claude Code, start `claude` again and complete the login.

## The browser sign-in never completes: 4 causes

1. **The browser didn't open, or the link can't be clicked.** Press `c` at the login prompt to copy the login URL and paste it into a browser yourself. This also works when the URL wraps across lines in a narrow or SSH terminal. `claude auth login` prints the URL too. When it finishes, the terminal shows `Login successful` and asks you to press `Enter`.
2. **You're on WSL2, SSH or in a container.** The browser opens on a different machine, so its redirect can't reach Claude Code's local callback server. After you sign in, the browser shows a code instead of redirecting back: paste it into the terminal at the `Paste code here if prompted` prompt. If no browser opens from WSL2 at all, set `BROWSER` to your Windows browser, for example `export BROWSER="/mnt/c/Program Files/Google/Chrome/Application/chrome.exe"`. If pasting does nothing, your terminal's paste shortcut isn't reaching the prompt: try right-click or Shift+Insert in Windows Terminal, or run `claude auth login`, which reads the pasted code from standard input.
3. **"OAuth error: Invalid code. Please make sure the full code was copied".** The code expired or was cut off when you copied it. Press Enter to retry and finish quickly after the browser opens. On a remote or SSH session, the browser may have opened on the wrong machine; copy the URL from the terminal and open it in your local browser.
4. **Claude Code can't listen on 127.0.0.1.** The sign-in returns through a local port. If a sandbox or security software blocks it, you see `The browser can't return the sign-in to Claude Code automatically`: just open the URL shown, sign in and paste the code at `Paste code here >`. If you see `Couldn't start the local listener that receives the browser sign-in`, run the command again, and if it stops the same way, use a token or API key instead (see cause 12). Piping input into `claude auth login` causes this too; run it in a real terminal. Before v2.1.305 this failed with `Failed to start OAuth callback server`, so update.

## Signed in, but requests fail: 5 causes

5. **An old `ANTHROPIC_API_KEY` is overriding your subscription.** This is the classic one. `API Error: 400 ... "This organization has been disabled"` while your subscription is active usually means a key from an old job or project is still exported. `Please run /login · API Error: 401 Invalid authentication credentials` can be the same thing: if `/status` shows an `API key` row that isn't marked as not in use, the key is what's being rejected. In interactive mode Claude Code asks once whether to use the key and remembers your answer; with `-p` it always uses the key when present. `/login` doesn't replace an approved key. **Fix:** `unset ANTHROPIC_API_KEY` (PowerShell: `Remove-Item Env:ANTHROPIC_API_KEY`), then remove the `export` line from `~/.zshrc`, `~/.bashrc` or `~/.profile` (on Windows, your `$PROFILE` and User environment variables). Run `env | grep ANTHROPIC` too: direnv, dotenv shell plugins and IDE terminals can load a stale key from a project `.env` file. The **Use custom API key** toggle in `/config` changes your earlier approval while the variable is set.
6. **`API Error: 403 Request not allowed` after login.** For Pro or Max, check that your subscription is active at claude.ai/settings. For Console accounts, your account needs the "Claude Code" or "Developer" role, which an admin assigns on the Console Members page. Behind a corporate proxy, the proxy may be interfering; our [proxy and SSL certificate errors guide](https://solostackkits.netlify.app/blog/claude-code-proxy-ssl-certificate-error.html) covers the settings and hosts to allow.
7. **"Claude Code access has not been granted for this account".** If the sign-in page shows this after you log in, your Claude Enterprise organization gave you the Custom role and none of your groups' custom roles includes Claude Code. Nothing in Claude Code fixes it: ask an Owner of your organization to grant a role with Claude Code access, then run `claude` and log in again.
8. **An `apiKeyHelper` script is failing.** If your settings name an `apiKeyHelper`, its output outranks your saved login for as long as the setting exists, so `/login` doesn't help. `Your apiKeyHelper script is failing` appears within three attempts when the command errors, times out, prints nothing or prints something other than the key. **Fix:** run the command yourself in a shell; it must print only the key to stdout and exit 0. If it reports an expired session, sign in to your SSO or vault again. `/status` shows an `apiKeyHelper` row reading `Failing` with the error output. To find which settings file defines it, our free [settings precedence checker](https://solostackkits.netlify.app/tools/settings-precedence-checker.html) shows which file wins.
9. **Your organization restricts the login.** An admin can set `forceLoginMethod` (`"claudeai"` or `"console"`) and `forceLoginOrgUUID` in managed settings. Then a login from another organization is reported as an error, the login prompt can reappear even after an earlier sign-in, and with `"claudeai"` an API key from an earlier Console login doesn't count as signed in (and the reverse with `"console"`). Environment credentials such as `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN` and `apiKeyHelper` are blocked at startup under these keys. **Fix:** log in with the account type and organization the policy names, or ask your admin to add you.

## It keeps asking you to log in: 3 causes

10. **The login expired.** `Login expired · Please run /login` means Claude Code tried to renew your saved claude.ai login, the refresh was rejected and the credentials were cleared; `OAuth token revoked` or `401 OAuth token has expired` means the API rejected it. Run `/login`. Claude Code warns three days ahead with `Your login expires in 3 days · run /login to renew`, and `/status` shows a `Login` row reading `Expired — log in again`. If it happens often, check that your system clock is accurate, since token validation depends on it. `Could not refresh your login because another Claude Code process is refreshing it` isn't a rejection: wait a minute, close other Claude Code windows, or run `/login`.
11. **The macOS Keychain won't save the login.** `Couldn't save your login. If your Mac's keychain is locked, unlock it and log in again.` means the login never completed. When the Keychain rejects a write, for example while locked in an SSH session, Claude Code falls back to `~/.claude/.credentials.json`. Run `claude doctor`; a `macOS Keychain is not writable` warning confirms it. Unlock it with `security unlock-keychain ~/Library/Keychains/login.keychain-db`, or resync the Keychain password in Keychain Access, then `/logout` and `/login`. Logging out removes all stored credentials, including MCP server logins and plugin secrets, so expect to re-enter those.
12. **Scripts, CI and `-p` runs don't have your login.** A `-p` command or Agent SDK program that relies on a saved login needs you to run `claude` in that same environment and complete `/login` first. For automation without a browser, run `claude setup-token`: it opens the same browser authorization and prints a one-year OAuth token (it doesn't save it). Set it as `CLAUDE_CODE_OAUTH_TOKEN` wherever the script runs. It needs a Pro, Max, Team or Enterprise plan and can only make model requests. `--bare` mode doesn't read `CLAUDE_CODE_OAUTH_TOKEN`, so bare scripts need `ANTHROPIC_API_KEY` or an `apiKeyHelper`. And if a 401 keeps coming back while this variable is set, Claude Code keeps sending its value: generate a fresh token, or unset it and run `/login`.

## Two special cases

- **Work and personal accounts.** Give each account its own configuration directory, for example `alias claude-work='CLAUDE_CONFIG_DIR=~/.claude-work claude'`. Each directory keeps its own settings, history and login, and the first run walks you through login again. Two Console sign-ins without an API key aren't kept apart this way, because that kind of sign-in is stored outside the configuration directory.
- **Bedrock, Google Cloud's Agent Platform or Microsoft Foundry.** No browser login is involved. `Could not load credentials from any providers` (Bedrock), `Could not load the default credentials` (Agent Platform) or `ChainedTokenCredential authentication failed` (Foundry) means the cloud CLI isn't signed in in that shell: check `aws sts get-caller-identity`, `gcloud auth application-default login` or `az login`. If it works in your terminal but not in the VS Code or JetBrains extension, the IDE didn't inherit your shell's environment; see our [IDE not connecting](https://solostackkits.netlify.app/blog/claude-code-ide-not-connecting.html) guide for the IDE side.

## Still stuck?

If the problem is that `claude` isn't found at all, see [Claude Code command not found](https://solostackkits.netlify.app/blog/claude-code-command-not-found.html). Run `claude doctor` for an automated report, and check `/status` again after each change. If the problem is the account rather than the install, such as a login loop, a subscription that isn't recognized or a disabled organization, contact Anthropic support from claude.ai (Console users: platform.claude.com) via your initials, then **Get help**. If a key in your `env` block or settings file seems to do nothing, [settings not applying](https://solostackkits.netlify.app/blog/claude-code-settings-not-applying.html) explains which file each key belongs in. If you're signed in but requests fail with a 429, 529, 500 or `You've hit your session limit`, see [Claude Code API errors](https://solostackkits.netlify.app/blog/claude-code-api-error.html).

Signing Claude in for GitHub Actions instead? A `claude setup-token` token or Console API key goes into a repository secret, not a browser login: see [Claude Code GitHub Action not working](https://solostackkits.netlify.app/blog/claude-code-github-actions-not-working.html). For `claude -p` scripts and other CI jobs, including why a leftover `ANTHROPIC_API_KEY` wins in print mode, see [Claude Code headless mode not working](https://solostackkits.netlify.app/blog/claude-code-headless-mode-not-working.html). Prefer to build a config yourself? Use the [free Claude Code tools](https://solostackkits.netlify.app/tools/) — they run in your browser, no signup.

---

Facts on this page come from Anthropic's Claude Code docs on [authentication](https://code.claude.com/docs/en/authentication), [troubleshooting installation and login](https://code.claude.com/docs/en/troubleshoot-install), [errors](https://code.claude.com/docs/en/errors) and the [CLI reference](https://code.claude.com/docs/en/cli-reference). This guide isn't affiliated with Anthropic.

Want a tested starting point? Our [Claude Code Power Config Pack](https://solostackkits.gumroad.com/l/claude-code-config-pack/LAUNCH50?utm_source=hashnode&utm_medium=article&utm_campaign=ssk_hashnode_login) has 6 lean CLAUDE.md templates, permission presets and 8 tested safety hooks, $6 with the launch code while it lasts.

Not ready to buy? Our [free safety hooks](https://solostackkits.gumroad.com/l/claude-code-free-safety-hooks?utm_source=hashnode&utm_medium=article&utm_campaign=ssk_hashnode_login) block risky commands before they run.