OAuth login fails in headless/container environments (code=true and org:create_api_key scope)

[linpap]

Description

When running Claude Code in a headless/container environment (e.g., Docker containers with ttyd web terminals), the /login flow generates an OAuth authorize URL that the claude.ai OAuth server rejects.

Environment

• Claude Code v2.1.63 (also reproduced on v2.1.42)
• Running inside Docker containers (Ubuntu 22.04) with ttyd web terminal
• Login method: Claude account with subscription (Max)

The Problem

Two issues in the generated OAuth URL when using the manual code-paste flow:

1. code=true parameter breaks authorization

The CLI adds code=true as a query parameter to the authorize URL:

https://claude.ai/oauth/authorize?code=true&client_id=...&response_type=code&...

The claude.ai OAuth server returns:

Invalid OAuth Request
Invalid response_type: missing. Expected: 'code'

This only happens in the manual code flow (headless environments). On a local machine, Claude Code uses redirect_uri=http://localhost:PORT/callback and doesn't add code=true, so login works fine.

2. org:create_api_key scope included for Claude.ai subscription login

The authorize URL includes org:create_api_key in the scope even when logging in via Claude.ai subscription (not Anthropic Console). The claude.ai OAuth server returns:

Invalid OAuth Request
Missing scope parameter

(This error also occurs when the URL is truncated due to terminal line wrapping, but the scope itself may also be rejected.)

Relevant Source Code

In cli.js (minified), the URL builder function:

j.searchParams.append("code","true"),  // <-- not a standard OAuth parameter
j.searchParams.append("client_id", ...)
j.searchParams.append("response_type","code")
// ...
let J = w ? [dS] : BU1;  // BU1 includes "org:create_api_key" via JHA
j.searchParams.append("scope", J.join(" "))

The scope arrays:

JHA = [jPK, "user:profile"]         // jPK = "org:create_api_key"
a61 = ["user:profile", dS, "user:sessions:claude_code", "user:mcp_servers"]
BU1 = Array.from(new Set([...JHA, ...a61]))
// Result: ["org:create_api_key", "user:profile", "user:inference", "user:sessions:claude_code", "user:mcp_servers"]

Workaround

Patching cli.js to:

1. Remove the j.searchParams.append("code","true") call
2. Change JHA=[jPK,"user:profile"] to JHA=["user:profile"]

After these patches, /login works correctly in container environments — the OAuth URL is accepted, the user can authorize, and the code exchange succeeds.

Expected Behavior

/login should work in headless/container environments where the manual code-paste flow is used, without requiring source patches.

Additional Context

The manual code flow uses redirect_uri=https://platform.claude.com/oauth/code/callback which correctly displays the auth code for the user to copy-paste back into the CLI. The flow itself works — only the URL construction is broken.

[github-actions]

Found 3 possible duplicate issues:

1. [BUG] Invalid OAuth Request: Unknown scope: org%3Acreate_api_key #20325
2. [BUG] Invalid OAuth Request - Unknown scope: user:sessions% #26874
3. feat(docs, auth): Document Headless/Remote Authentication and Support CI/CD #7100

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[github-actions]

This issue has been automatically closed as a duplicate of #20325.

If this is incorrect, please re-open this issue or create a new one.

🤖 Generated with Claude Code

[github-actions]

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.