Field note
Claude Code Authentication Errors: SSO Checks
Most Claude Code login failures come from the wrong credential winning, an expired session or an organisation policy, and each of those has a different owner.
Most Claude Code login failures come from the wrong credential winning, an expired session or an organisation policy, and each of those has a different owner.
Match the message first
Claude Code reports authentication problems with specific wording. Read the exact text before touching anything.
| What you see | What it usually means |
|---|---|
OAuth error: Invalid code | The login code expired or was cut short when pasted |
API Error: 403 ... Request not allowed | The account has no active subscription or no Claude Code role, or a proxy is interfering |
This organization has been disabled with an active subscription | An old ANTHROPIC_API_KEY in your shell is overriding your subscription login |
Claude Code access has not been granted for this account | Your Enterprise organisation uses custom roles and none of yours grants Claude Code |
Login expired · Please run /login | The saved login has lapsed and could not be refreshed |
| Browser opens but the terminal never continues | The browser cannot reach the local callback, which is normal in WSL2, SSH and containers |
Likely causes, most common first
- A stale API key. Claude Code prefers
ANTHROPIC_API_KEYover your subscription login once you have approved it. A key left in.zshrcor.bashrcfrom an old project or employer is the single most common cause of confusing errors. - No seat or role. On Claude for Teams or Enterprise you need an invitation to the organisation. On the Claude Console you need the Claude Code or Developer role. Enterprise custom roles can remove access even when the seat exists.
- The callback cannot reach you. In WSL2, over SSH or inside a container the browser runs on a different host, so the sign-in shows a code to paste instead of redirecting.
- An expired or corrupted saved login. Logins expire, and on macOS a locked Keychain can stop Claude Code from saving the new one properly.
- Organisation policy. Admins can force a login method or organisation through managed settings. A developer signed in to the wrong organisation is rejected at startup.
- Proxy interference. Corporate proxies can break the API requests that follow a successful login.
Step-by-step fix
-
Run
/statusinside Claude Code. It shows which credential is active and marks the one not in use, which answers most questions in ten seconds. -
If an API key is active and you meant to use the subscription, unset it and remove the export from your shell profile:
unset ANTHROPIC_API_KEY claudeOn Windows PowerShell use
Remove-Item Env:ANTHROPIC_API_KEY, then check$PROFILEand your user environment variables. -
Reset the login cleanly: run
/logout, close Claude Code, startclaudeagain and complete sign-in. Logging out also removes saved MCP server logins, so expect to re-authorise those. -
If the browser does not open, press
cto copy the sign-in URL and paste it into a browser on your own machine. If the browser shows a code, paste it at thePaste code here if promptedprompt. If pasting does nothing, runclaude auth login, which reads the code from standard input. -
On macOS, run
claude doctor. A warning that the Keychain is not writable means the login is falling back to a plain file. Unlock the Keychain, then/logoutand/loginto move the credential back. -
If the machine's clock is wrong, fix it. Token validation depends on accurate time and a drifted clock causes repeat logins.
Never paste an API key, OAuth token or the contents of ~/.claude/.credentials.json into a ticket, a chat or a screenshot. Support does not need it, and a leaked key is a rotation job for the admin.
What the admin should check
- Seats and roles. Confirm the user is a member of the organisation with a seat, and on Console has the Claude Code or Developer role. On Enterprise, check custom role assignments for the user's groups.
- SSO configuration. The identity provider assignment must include the user. Anthropic's SSO article covers the setup; the same Entra ID group hygiene you apply to Microsoft 365 applies here.
- Managed settings.
forceLoginMethodandforceLoginOrgUUIDcontrol which login and organisation developers may use. If/statuson the developer's machine shows a different organisation from the one you enforce, that is the rejection. Deploy the keys through device management so they apply before first login. - Proxy and network. Confirm the proxy allows the Anthropic API endpoints and does not rewrite them.
- Old keys. Search build servers and shared machines for
ANTHROPIC_API_KEYexports left by earlier projects, and rotate any that should not exist.
Our Claude Code workshop sets up identity, permissions and review gates together, and the Entra ID conditional access page covers the identity side for Microsoft-based businesses.
When to escalate to Anthropic
Escalate when the account rather than the machine is the problem: a subscription that is not recognised, a disabled organisation, a login loop after a clean reset, or an assigned role that still does not take effect. Sign in at claude.ai (Console users at platform.claude.com), open the menu under your initials and choose Get help. Include the operating system, the version from claude --version, the exact error text and the time. Do not include credentials.
If claude will not start at all, claude doctor and the GitHub issue tracker are the better route.