Claude Code Not Logging In? Fix Every Login and OAuth Error

Jump to: quick triage · won't log in at all · "OAuth error: Invalid code" · 403 after login · "access has not been granted" · "organization has been disabled" · fails in WSL2, SSH, or a container · logged out repeatedly · things worth clarifying

Start Here: Match the Error Before You Change Anything

1. Check status.claude.com first. As of this writing it shows all systems operational, with no login or authentication incident listed — but a 500/503 error or a login that fails for everyone at once is worth a quick check there before you touch local settings.
2. Read the exact error text. Claude Code's login and authentication errors are specific enough to point straight at a fix — "Invalid code" is not the same problem as a 403, and neither is the same as "this organization has been disabled."
3. Note your environment. A browser that can't redirect back to Claude Code (WSL2, SSH, a container) fails differently than a plain desktop install, and needs a different fix.

Error 1 - Claude Code Won't Log In, With No Clear Error

What you see: running claude or /login doesn't complete sign-in, the browser doesn't open, or the terminal seems stuck after you approve the login in the browser.

Why it happens

A clean re-authentication resolves most logins that fail without a specific error message, since a half-finished previous login attempt can leave Claude Code in a state where a new one doesn't take.

How to fix it

1. Run /logout to sign out completely.
2. Close Claude Code.
3. Restart with claude and go through the authentication process again.
4. If the browser doesn't open automatically, press c to copy the OAuth URL to your clipboard, then paste it into a browser manually. This also fixes a URL that wraps across lines in a narrow or SSH terminal and can't be clicked.

What you should see: the browser completes the sign-in flow and Claude Code returns to its normal prompt, logged in.

Error 2 - "OAuth error: Invalid code"

What you see: OAuth error: Invalid code. Please make sure the full code was copied.

Why it happens

The login code either expired or was truncated while it was copied and pasted.

How to fix it

1. Press Enter to retry, and complete the login quickly once the browser opens — the code is time-limited.
2. If the browser didn't open automatically, type c to copy the full URL rather than retyping it by hand.
3. On a remote or SSH session, the browser may try to open on the wrong machine. Copy the URL shown in the terminal and open it in your local browser instead.

What you should see: a fresh login completes without the "Invalid code" message reappearing.

Error 3 - "API Error: 403 Request not allowed" After Login

What you see: login appears to succeed, but Claude Code then returns API Error: 403 Request not allowed.

Why it happens

A 403 after a completed login points to the account or network, not the login step itself: an inactive subscription, a Console account without the right role, or a corporate proxy interfering with the request.

How to fix it

1. Claude Pro/Max: verify your subscription is active at claude.ai/settings.
2. Anthropic Console: confirm your account has the "Claude Code" or "Developer" role. An Admin assigns this on the Console's Members page at platform.claude.com/settings/members.
3. Behind a corporate proxy: proxies can interfere with API requests; check your proxy configuration before assuming the account is the problem.

What you should see: the same command that returned the 403 completes normally once the subscription, role, or proxy issue is resolved.

Error 4 - "Claude Code Access Has Not Been Granted for This Account"

What you see: after logging in, the sign-in page shows Authorization failed with Claude Code access has not been granted for this account. Contact your administrator.

Why it happens

Your Claude Enterprise organization has set your role to Custom, and none of the custom roles assigned to your groups grants Claude Code. On the Custom role, access comes only from those assigned custom roles, so nothing you change inside Claude Code resolves this.

How to fix it

1. Ask an Owner of your Claude organization to assign a custom role that grants Claude Code access to one of your groups, or to change your role from Custom to a standard role such as User. Owners manage this in the organization's role settings at claude.ai/admin-settings/roles.
2. After the Owner makes the change, run claude and log in again.

What you should see: login completes without the "Authorization failed" message, once an Owner has updated your role.

Error 5 - "This Organization Has Been Disabled" With an Active Subscription

What you see: API Error: 400, with the message "This organization has been disabled," despite having an active Claude subscription.

Why it happens

An ANTHROPIC_API_KEY environment variable is overriding your subscription's OAuth credentials. This commonly happens when an old API key from a previous employer or project is still set in your shell profile — when that variable is present (and approved), Claude Code uses it instead of your subscription login, and in non-interactive mode (the -p flag) it's always used when present.

How to fix it

1. Unset the variable for the current session: unset ANTHROPIC_API_KEY on macOS/Linux, or Remove-Item Env:ANTHROPIC_API_KEY in Windows PowerShell.
2. Check ~/.zshrc, ~/.bashrc, or ~/.profile for a line starting with export ANTHROPIC_API_KEY= and remove it so the fix is permanent. On Windows, check your PowerShell profile at $PROFILE and your User environment variables.
3. Run claude again, then run /status inside Claude Code to confirm which authentication method is now active.

What you should see: /status shows your subscription's OAuth login as the active method, and the "organization has been disabled" error stops appearing.

Error 6 - Login Fails or Hangs in WSL2, SSH, or a Container

What you see: you start the login flow inside WSL2, over SSH, or inside a container, and either the browser never redirects back or nothing happens after you approve the sign-in.

Why it happens

The browser opens on a different host than the one running Claude Code, so its redirect can't reach Claude Code's local callback server. After signing in, the browser shows a login code instead of redirecting automatically.

How to fix it

1. Paste the code the browser shows into the terminal at the Paste code here if prompted prompt to complete login.
2. If the browser doesn't open at all from WSL2, set the BROWSER environment variable to your Windows browser's path before logging in: export BROWSER="/mnt/c/Program Files/Google/Chrome/Application/chrome.exe".
3. As an alternative, press c at the interactive login prompt to copy the OAuth URL and open it manually in a browser on your local machine.
4. If pasting the code into the interactive prompt does nothing, your terminal's paste binding likely isn't reaching the input field (try the terminal's alternate paste shortcut, often right-click or Shift+Insert in Windows Terminal) — or use claude auth login instead, which reads the pasted code from standard input. This also applies on native Windows or any terminal where the interactive prompt won't accept a paste.

What you should see: login completes once the code is pasted or the URL is opened manually, even though no automatic redirect happened.

One related report worth flagging honestly: a Windows 11 user once filed an issue for this exact error — OAuth error together with ECONNREFUSED on a fresh install, with basic network checks passing — on Anthropic's GitHub tracker. It was closed as a duplicate of a broader login-failure thread that was itself attributed to a status-page incident, though later commenters on that thread reported the problem persisting for them. If the steps above don't resolve a plain ECONNREFUSED on a native install (not WSL2, SSH, or a container), that's worth reporting with your Claude Code version and OS rather than assuming a documented fix already exists.

Error 7 - Logged Out Repeatedly, or Stuck on "Not Logged In"

What you see: Claude Code asks you to log in again after a session ends, or several sessions on the same machine all prompt for login at once.

Why it happens

Usually an expired OAuth token. If it happens often, an inaccurate system clock is a common cause, since token validation depends on correct timestamps. Parallel sessions on one machine share a saved login and coordinate its renewal so only one process refreshes the token at a time; before Claude Code v2.1.211, waking the machine from sleep could cause two sessions to renew with the same token at once, which revoked the saved login and prompted every open session to log in again simultaneously. On macOS specifically, Claude Code normally saves credentials to the login Keychain (macOS's built-in credential manager); if the Keychain rejects the write — locked during an SSH session, or its password out of sync with your account password — Claude Code falls back to a plaintext credentials file instead, and a Console login that creates an API key fails until the Keychain is writable again.

How to fix it

1. Run /login to re-authenticate.
2. If it happens frequently, confirm your system clock and time zone are set to sync automatically.
3. On macOS, run claude doctor to check Keychain access. A warning starting with macOS Keychain is not writable means that's the cause.
4. If the Keychain warning appears, unlock it with security unlock-keychain ~/Library/Keychains/login.keychain-db, run claude doctor again, and if the warning persists, open Keychain Access, select the login keychain, and use Edit > Change Password for Keychain "login" to resync it with your account password.
5. Once claude doctor no longer shows the Keychain warning, run /logout then /login to move your credentials back into the encrypted Keychain. This also clears saved MCP server logins and plugin secrets, so expect to re-authorize those afterward.

What you should see: Claude Code stays logged in across sessions, and claude doctor no longer reports a Keychain warning.

Things Worth Clarifying

• A subscription login and an API key are two different credentials, and one can silently beat the other. Claude Code uses ANTHROPIC_API_KEY over your subscription's OAuth login whenever that variable is set and approved — including in scripts and automation (-p flag), where it's always used if present. Run /status if you're ever unsure which one is active.
• You can use Claude Code without running the interactive /login flow at all. Setting ANTHROPIC_API_KEY gives Claude Code a working credential without any OAuth sign-in — this is the same variable that causes Error 5 when it's set by accident, so it's worth knowing on purpose if you'd rather authenticate this way from the start.
• "Access has not been granted" is not something retrying fixes. That specific message is an Enterprise role problem that only an organization Owner can resolve — it's not a local bug or a glitch that clears on its own.
• A redirect that doesn't fire in WSL2, SSH, or a container isn't a bug. It's an expected consequence of the browser running on a different host than Claude Code; pasting the code or setting BROWSER is the documented path, not a workaround for broken behavior.

When It Isn't a Bug

• A 500, 503, or 529 error isn't something to fix locally. These are typically a temporary service issue; check status.claude.com and retry after a few minutes.
• Being asked to re-authorize MCP servers and plugin secrets after a Keychain-related /logout//login isn't a bug. Logging out clears all stored credentials, including those, by design.
• An Enterprise org restricting Claude Code access by role isn't a Claude Code problem to debug. That's an intentional organization-level control that only an Owner can change.

What to Include When You Ask for Help

• the exact error text, word for word (an "Invalid code" OAuth error, a 403, a 400 "organization disabled," or something else);
• the output of claude doctor, run from a normal shell;
• what /status shows for your active authentication method;
• whether you're on a plain desktop install, WSL2, SSH, or a container.

Related

For a Claude Code MCP server stuck on "Needs authentication" or failing to connect — a different kind of auth error, tied to individual MCP servers rather than your Claude Code account — see Claude Code MCP Not Working? Fix Connection and Auth Errors. For other Claude Code problems unrelated to login or MCP — reverted changes, context compaction, permission denials and more — see the full Claude Code troubleshooting guide. For an overview of what Claude Code covers as a platform, see the Claude Code platform page.

Frequently Asked Questions

Sources

Checked on October 19, 2026:

• Claude Code docs: Troubleshoot installation and login
• Claude status page