OAuth login fails from Hetzner VPS — Cloudflare JS challenge blocks token exchange

[arthurworsley]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

The OAuth login flow fails at the token exchange step when running Claude Code on a Hetzner Cloud VPS. Cloudflare issues a JavaScript challenge that the CLI cannot complete, blocking the outbound HTTPS request.

Steps:

1. SSH into VPS, run claude login
2. CLI displays authorization URL
3. Open URL in local browser, sign in, authorize successfully
4. Receive authorization code, paste it back into the CLI
5. CLI fails with: "OAuth error: Request failed with status code 400"

Root cause — Cloudflare blocks claude.ai from the VPS:

$ curl -sS -D - -o /dev/null https://claude.ai/
HTTP/2 403
cf-mitigated: challenge
server: cloudflare

The cf-mitigated: challenge header confirms a JS challenge is being issued. The CLI cannot complete this challenge, so the token exchange request fails.

• Both IPv4 and IPv6 return 403
• console.anthropic.com returns HTTP 302 (OK) — only claude.ai is blocked
• Previously authenticated successfully as root on the same server

What Should Happen?

The OAuth token exchange should succeed. The token exchange endpoint should be exempt from Cloudflare bot challenges for CLI/API clients (e.g. by User-Agent or endpoint path), or an alternative headless authentication method should be provided.

Error Messages/Logs

OAuth error: Request failed with status code 400

Full response headers from VPS:

HTTP/2 403
date: Thu, 29 Jan 2026 11:28:40 GMT
content-type: text/html; charset=UTF-8
cf-mitigated: challenge
server: cloudflare

Steps to Reproduce

1. Provision a Hetzner Cloud VPS (any plan, ARM64 or x86)
2. Install Claude Code via npm
3. Run claude login
4. Complete the browser authorization, paste code back
5. Observe "OAuth error: Request failed with status code 400"

Claude Model

Claude Pro (subscription)

Is this a regression?

Yes, this worked in a previous version

Last Working Version

Unknown — previously worked as root on same server

Claude Code Version

v2.1.23

Platform

Claude.ai (Pro subscription)

Operating System

Ubuntu 24.04.3 LTS (Noble Numbat), ARM64, Hetzner Cloud

Terminal/Shell

Bash via SSH

Additional Information

• VPS provider: Hetzner Cloud (ARM64)
• Hetzner is a major European cloud provider — this likely affects all Hetzner customers
• Related issues: OAuth authentication fails with 400 error for Pro subscription #10719, OAuth token expired immediately after fresh login - cannot use Claude Code (blocking) #19078, [BUG] OAuth error: Failed to start OAuth callback server: listen EPROTONOSUPPORT: protocol not supported ::1 #9534, [BUG] Claude Pro authentication not persisting on Linux #5767
• Workaround attempted: copying OAuth tokens from macOS Keychain to Linux gnome-keyring — works but breaks when token refresh also hits Cloudflare

[github-actions]

Found 3 possible duplicate issues:

1. [BUG] OAuth login hangs when Cloudflare challenges CLI requests #16979
2. [BUG] infinite cloudflare loop #18954
3. [BUG] OAuth error: Request failed with status code 403 #8007

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[covalent-dev]

Confirming this exact issue on a Hetzner VPS as of today (Feb 20, 2026).

$ curl -sS -D - -o /dev/null https://claude.ai/
HTTP/2 403
cf-mitigated: challenge
server: cloudflare

OAuth login fails completely — copying the login link and completing it in the browser just results in "OAuth request failed." Previously this worked fine on the same VPS. The credential copy workaround from
macOS is not viable since it breaks on the next token refresh, which also hits claude.ai and gets challenged.

This effectively makes Claude Code unusable on Hetzner with a Pro subscription. The only workaround is paying for API credits on top of an existing subscription, which shouldn't be necessary.

Can we get an update on whether this is being looked at? Exempting the OAuth token exchange endpoint from Cloudflare
challenges seems like a straightforward fix.

[slayer]

that is the real problem. even /login does not help