Issue Station
Sign In
Tools hereToolbox

claude-code - 💡(How to fix) Fix Multiple concurrent CLI sessions cause auth failure on token refresh (race condition) [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
anthropics/claude-code#48786•Fetched 2026-04-16 06:50:59
View on GitHub
Comments
1
Participants
2
Timeline
5
Reactions
0
Author
coolbossovcoolbossov
Participants
coolbossovcoolbossovgithub-actions[bot]github-actions[bot]
Timeline (top)
labeled ×4commented ×1

When running multiple concurrent Claude Code CLI sessions (4-7+), all sessions simultaneously lose authentication when the OAuth access token expires (~8 hours). This forces a full re-login across every session.

Root Cause

All CLI sessions share a single ~/.claude/.credentials.json file with one refresh token. There is no file-locking or coordination mechanism to prevent concurrent refresh attempts. With rotating refresh tokens, only one refresh can succeed — the rest invalidate.

This is especially problematic for:

  • Users running multiple terminal sessions
  • SSH connections (no browser fallback for re-auth)
  • Sessions bridged from the desktop app
RAW_BUFFERClick to expand / collapse

Description

When running multiple concurrent Claude Code CLI sessions (4-7+), all sessions simultaneously lose authentication when the OAuth access token expires (~8 hours). This forces a full re-login across every session.

Environment

  • OS: macOS 15 (Darwin 25.4.0)
  • Claude Code version: 2.1.109
  • Auth method: claude.ai OAuth (.credentials.json plaintext fallback)
  • Subscription: Claude Max
  • Concurrent sessions: 4-7 interactive CLI sessions + desktop bridge + remote-control

Steps to Reproduce

  1. Log in to Claude Code CLI (claude auth login)
  2. Open 4+ concurrent CLI sessions (e.g., multiple terminal tabs or SSH sessions)
  3. Wait for the OAuth access token to expire (~8 hours)
  4. All sessions simultaneously fail with a login prompt

Expected Behavior

Token refresh should be coordinated so that only one session refreshes the token, and all other sessions pick up the new credentials from .credentials.json.

Actual Behavior

Multiple sessions race to refresh the expired access token simultaneously. If the OAuth server uses rotating refresh tokens:

  • The first session to complete refresh succeeds and writes new tokens to .credentials.json
  • All other sessions attempt to refresh with the now-invalidated old refresh token
  • Those sessions fail and show a /login prompt
  • Result: all sessions except one are logged out simultaneously

Root Cause Analysis

All CLI sessions share a single ~/.claude/.credentials.json file with one refresh token. There is no file-locking or coordination mechanism to prevent concurrent refresh attempts. With rotating refresh tokens, only one refresh can succeed — the rest invalidate.

This is especially problematic for:

  • Users running multiple terminal sessions
  • SSH connections (no browser fallback for re-auth)
  • Sessions bridged from the desktop app

Suggested Fix

  • File-lock-based refresh coordination: Only one process performs the refresh, others wait and read the updated credentials
  • Grace period for old refresh tokens: Accept the previous refresh token for a short window after rotation
  • Per-session token management: Each CLI session maintains its own OAuth tokens

Additional Context

  • CLAUDE_CODE_OAUTH_TOKEN (from claude setup-token) returns 401 "OAuth authentication is currently not supported" — this headless auth path appears broken as well
  • Running claude setup-token may also revoke the existing refresh token server-side, causing all active sessions to fail once their access token expires

extent analysis

TL;DR

Implementing a file-lock-based refresh coordination mechanism can help prevent multiple CLI sessions from simultaneously losing authentication when the OAuth access token expires.

Guidance

  • To mitigate the issue, consider using a file-locking mechanism to ensure only one process performs the token refresh at a time, while others wait and read the updated credentials.
  • Verify the issue by running multiple concurrent CLI sessions and checking if the authentication loss occurs when the OAuth access token expires.
  • Investigate the feasibility of implementing a per-session token management approach, where each CLI session maintains its own OAuth tokens, to avoid shared token issues.
  • Review the CLAUDE_CODE_OAUTH_TOKEN setup and ensure it does not inadvertently revoke existing refresh tokens, causing session failures.

Example

No code snippet is provided as the issue does not contain sufficient technical details to create a specific example.

Notes

The suggested fix may require significant changes to the Claude Code CLI authentication mechanism, and careful consideration should be given to the implementation to avoid introducing new issues.

Recommendation

Apply a workaround, such as implementing a file-lock-based refresh coordination mechanism, as it appears to be a viable solution to prevent multiple sessions from losing authentication simultaneously.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#conversation history#tool integration#LLM response#prompt template#agent execution

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

claude-code - 💡(How to fix) Fix Multiple concurrent CLI sessions cause auth failure on token refresh (race condition) [1 comments, 2 participants]