OAuth login on headless EC2: code paste broken after recent update

[vgopinath]

Problem

After a recent Claude CLI update, the OAuth login flow on headless EC2 instances no longer allows reliable copy-paste of the OAuth code.

Environment

• Ubuntu 24.04 on EC2 (headless, no browser)
• SSH from Windows terminal
• Claude CLI (latest)

What broke

1. claude auth login prints an OAuth URL and prompts for the code
2. After authorizing in a local browser, the returned code (format: XXXXXX#YYYYYY) cannot be pasted back reliably:
   • Ctrl+V doesn't work in SSH terminals on Windows
   • The # character in OAuth codes gets interpreted as a shell comment
   • Right-click paste is unreliable
   • Piping via echo "code" | claude auth login opens a new PKCE flow, ignoring the piped input
   • expect cannot detect the raw terminal > prompt

Current workaround

Using tmux send-keys to deliver the code into the same process that generated the PKCE challenge:

# Start login in tmux
tmux new-session -d -s login 'bash -lc "claude auth login" 2>&1 | tee /tmp/tmux_login.log'
sleep 6
cat /tmp/tmux_login.log
# Open the URL in local browser, get the code, then:
tmux send-keys -t login "CODE_HERE" Enter

This works but is cumbersome for production environments with multiple EC2 instances.

Suggestion

Consider one of:

• A --code flag: claude auth login --code <oauth-code> (non-interactive)
• A file-based flow: claude auth login --code-file /tmp/oauth-code.txt
• Support for piped stdin: echo "code" | claude auth login
• A device-code flow that doesn't require pasting back into the CLI

What Does NOT Work

Method	Why It Fails
Copying credentials from local machine	OAuth tokens are machine-bound
Piping stdin via echo "code" | claude auth login	CLI opens a new OAuth flow
expect with prompt matching	Raw terminal input undetectable
Starting multiple login attempts	Each creates new PKCE challenge
Ctrl+V / right-click paste in SSH	Unreliable on Windows; # in codes breaks

Key Insight: PKCE Challenge Binding

Each claude auth login generates a unique code_challenge. The OAuth code returned after authorization is cryptographically bound to that specific challenge. This means:

• You MUST use the code with the SAME session that generated the URL
• Starting a new claude auth login invalidates all previous codes
• The tmux approach works because send-keys types into the SAME process

[ashwin-ant]

This is a duplicate of #47699, which was fixed as of version 2.1.108.

---

Generated by Claude Code

[github-actions]

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.