claude-code - 💡(How to fix) Fix [BUG] claude auth logout claims success but does not actually clear the persisted authentication state on Claude Code v2.1.133 (macOS)

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

claude auth logout claims success but does not actually clear the persisted authentication state on Claude Code v2.1.133 (macOS). Reproduction:

$ claude auth logout Successfully logged out from your Anthropic account.

$ claude auth status { "loggedIn": true, "authMethod": "oauth_token", "apiProvider": "firstParty" } The token survives across auth logout, full app reinstalls (rm -rf ~/.local/share/claude), removal of ~/.claude.json and ~/.claude/, deletion of every Claude-related entry from both the macOS login keychain and the iCloud keychain, removal of all Claude Desktop / Cowork bridge state, unsetting all ANTHROPIC_* and CLAUDE_CODE_* env vars, and a full system reboot. Whatever store this token lives in, the logout codepath is not reaching it. As a downstream consequence, /login from inside the CLI does not honor the user's subscription choice. Even when explicitly selecting Option 1 ("Claude account with subscription · Pro, Max, Team, or Enterprise"), the resulting session header reads · API Usage Billing and inference traffic is routed against the API plan rather than the user's Max subscription. The OAuth flow URL invoked by Option 1 is identical to the API/Console flow (client_id=9d1c250a-e61b-44d9-88ed-5944d1962f5e, scopes including org:create_api_key), suggesting the "subscription" branch may not be a distinct OAuth flow at all in this build, or the persisted ghost token from the failed logout overrides whatever the new login produces. Two macOS machines (Mac M4 chip and Mac M5 chip), both running Claude Code v2.1.133 from the same official installer, on the same Anthropic account with active Max 20x subscription. Identical login flow. M5 ends up correctly on · Claude Max. M4 ends up on · API Usage Billing. The divergence persists across every clean-slate reset attempted on M4. Onset was abrupt, between sessions on consecutive days, with no conscious configuration change — most likely a background auto-update to 2.1.133 introduced a regression.

What Should Happen?

claude auth logout should fully invalidate and remove the persisted authentication state from every store the CLI consults. After auth logout, auth status must return { "loggedIn": false } until the next successful auth login / /login. When the user invokes /login and selects Option 1 ("Claude account with subscription"), the CLI should initiate the subscription OAuth flow (not the API/Console flow), persist the resulting subscription tokens, and bill subsequent inference traffic against the user's Pro/Max/Team/Enterprise plan. The session header should reflect this with · Claude Max (or the relevant plan label) — not · API Usage Billing. If the user has both an active subscription and an API plan on the same account, the subscription must take precedence whenever the user explicitly chose it via /login. Concretely:

auth logout clears every credential store (~/.claude.json oauthAccount, all Claude Code-credentials* keychain entries, any iCloud-Keychain copies, any internal cache). auth status is a pure read of the same store(s) and reflects logout immediately. /login Option 1 routes to a subscription OAuth flow distinct from the API flow, with scopes that do not include org:create_api_key. After Option 1 login, the header reads · Claude Max (or the user's actual subscription tier) and traffic bills against that subscription.

Error Messages/Logs

No error is surfaced to the user — that's part of the problem. Every command returns success:
$ claude auth logout
Successfully logged out from your Anthropic account.

$ claude auth status
{
  "loggedIn": true,
  "authMethod": "oauth_token",
  "apiProvider": "firstParty"
}

$ claude
   Claude Code v2.1.133
   Opus 4.7 (1M context) with xhigh effort · API Usage Billing
   /Users/udi

> /login
  ❯ 1. Claude account with subscription · Pro, Max, Team, or Enterprise
    2. Anthropic Console account · API usage billing
    3. 3rd-party platform · Amazon Bedrock, Microsoft Foundry, or Vertex AI

[Option 1 selected, browser OAuth flow completes successfully]
Login successful.

$ claude
   Claude Code v2.1.133
   Opus 4.7 (1M context) with xhigh effort · API Usage Billing   ← still
   /Users/udi
Because no error fires, traffic silently bills against the API plan instead of the subscription the user selected — which on accounts with API auto-reload enabled can rack up significant unintended spend before the user notices. A mismatch between the selected login method and the resulting apiProvider should at minimum produce a warning, ideally a hard failure that requires the user to acknowledge the fallback.

Steps to Reproduce

macOS, Claude Code v2.1.133 claude auth logout claude auth status → returns loggedIn: true (expected: false) claude → /login → Option 1 → complete OAuth in browser Restart claude → header still reads · API Usage Billing (expected: · Claude Max)

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

No response

Claude Code Version

2.1.133

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

No response