Introduction
Authentication is the first thing that breaks in Claude Code, and the most consequential — because one class of failure doesn't just block you, it silently charges you. Claude Code can authenticate two ways: with the OAuth login tied to your Claude Pro or Max subscription, or with an ANTHROPIC_API_KEY that bills per token through the Anthropic Console. When those two get crossed, you see errors like 403 Forbidden, "This organization has been disabled," or an unexpected pay-as-you-go bill on an account you thought was covered by your plan.
This guide walks through the authentication errors developers actually hit, in the order you should diagnose them. The single most important command is /status, because most of these problems are really one problem wearing different error messages: Claude Code is using a credential you didn't intend.
Start here: which credential is active?
Before touching anything, find out what Claude Code is authenticating with right now. Inside a session, run:
/status
This shows whether you're on your subscription's OAuth login or an API key. If it says API key and you expected your subscription — that's your bug, and the next section fixes it. Make /status a habit before any important or long-running work; it takes a second and prevents the most expensive mistake in this guide.
The expensive one: ANTHROPIC_API_KEY overriding your subscription
Here is the trap. When an ANTHROPIC_API_KEY environment variable is present and you've approved it, Claude Code uses that key instead of your subscription's OAuth credentials. The API key bills per token; your subscription does not. So a leftover key — commonly one exported in a shell profile from a previous employer or an old project — quietly redirects your usage to pay-as-you-go billing.
Two symptoms point here:
- Surprise per-token charges despite an active Pro or Max plan.
API Error: 400 ... "This organization has been disabled", even though your subscription is fine.
The fix is to unset the variable and remove it permanently:
unset ANTHROPIC_API_KEY
claude
That clears it for the current shell. To make it stick, open ~/.zshrc, ~/.bashrc, or ~/.profile and delete any export ANTHROPIC_API_KEY=... line. On Windows, check your PowerShell profile ($PROFILE) and your User environment variables. Then confirm with /status that OAuth is now active.
One caveat worth knowing: in non-interactive mode with the -p flag, the key is always used when present. That's intended for CI and scripting, but it means the same leftover variable that annoys you interactively will silently take over an automated run too.
Reset a broken login
When login fails and the cause isn't obvious, a clean re-authentication resolves most cases. Don't debug in circles — reset:
- Run
/logoutto sign out completely. - Close Claude Code.
- Restart with
claudeand complete the login again.
If the browser doesn't open automatically, press c to copy the OAuth URL to your clipboard and paste it into a browser manually. This also handles the case where the URL wraps across lines in a narrow or SSH terminal and can't be clicked.
"403 Forbidden" after login
If you see API Error: 403 {"error":{"type":"forbidden","message":"Request not allowed"}} right after logging in, the login itself worked but your account isn't authorized for the request. Check by account type:
- Pro/Max users — verify your subscription is active at claude.ai/settings.
- Console users — confirm your account has the "Claude Code" or "Developer" role. An admin assigns this in the Anthropic Console under Settings → Members.
- Behind a corporate proxy — proxies can interfere with API requests; this is a common hidden cause in enterprise networks.
"OAuth error: Invalid code"
If login reports OAuth error: Invalid code. Please make sure the full code was copied, the login code either expired or was truncated during copy-paste. Complete the flow quickly after the browser opens, and if you're copying the code manually, make sure you grabbed all of it. On a remote or SSH session the browser may open on the wrong machine entirely — copy the URL shown in the terminal and open it in your local browser instead.
Logging in over SSH, WSL2, or in a container
This is its own category because the normal browser redirect can't work. When Claude Code runs in WSL2, over SSH, or inside a container, the browser opens on a different host and its redirect can't reach Claude Code's local callback server. After you sign in, the browser shows a login code — paste it into the terminal at the prompt.
If the browser doesn't open at all from WSL2, point Claude Code at your Windows browser:
export BROWSER="/mnt/c/Program Files/Google/Chrome/Application/chrome.exe"
claude
And if pasting into the interactive prompt does nothing (a terminal paste-binding issue), use the command that reads the code from standard input instead:
claude auth login
The token keeps expiring
If Claude Code prompts you to log in again after every session, your OAuth token is expiring when it shouldn't. Run /login to re-authenticate, then check the likely root causes:
- System clock — token validation depends on correct timestamps. A clock that's off will invalidate perfectly good tokens.
- macOS Keychain — login can fail when the Keychain is locked or its password is out of sync with your account, which prevents Claude Code from saving credentials. Run
claude doctorto check Keychain access. To unlock it manually:
security unlock-keychain ~/Library/Keychains/login.keychain-db
If unlocking doesn't help, open Keychain Access, select the login keychain, and use Edit → Change Password to resync it with your account password.
Conclusion
Most Claude Code authentication errors trace back to a single question: which credential is Claude Code actually using? The answer comes from /status, and the most costly failure — a stray ANTHROPIC_API_KEY redirecting a subscription user to per-token billing — is invisible until you look. Build two habits: check /status before important work, and keep your shell profile free of API keys you no longer need. For everything else — expired tokens, 403s, remote logins — a clean /logout and /login cycle resolves the majority of cases.
To understand the difference between the two billing paths in more depth, see our glossary entries on the API and the token as the unit you're billed on.