Bug Description
cliproxyapi -claude-login fails with a 403 error during OAuth token exchange. The token endpoint at https://console.anthropic.com/v1/oauth/token is protected by a Cloudflare managed challenge that requires JavaScript execution, making it impossible for any programmatic HTTP client (Go, curl, Python, etc.) to complete the request.
Steps to Reproduce
cliproxyapi -claude-login
The browser opens and OAuth authorization at claude.ai succeeds, but the subsequent token exchange POST fails:
[error] [claude.go:187] Token exchange failed: token exchange failed with status 403: <!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title>...
The same 403 occurs with curl, confirming it's a server-side WAF rule (not a TLS/HTTP fingerprinting issue):
curl -s -o /dev/null -w "%{http_code}" -X POST \
-H "Content-Type: application/json" \
-d '{"grant_type":"authorization_code","client_id":"9d1c250a-e61b-44d9-88ed-5944d1962f5e","code":"test"}' \
"https://console.anthropic.com/v1/oauth/token"
# Returns: 403 (Cloudflare managed challenge HTML)Root Cause
Cloudflare has enabled a managed challenge (cType: 'managed') on console.anthropic.com that blocks all non-browser requests to /v1/oauth/token. This cannot be bypassed with uTLS fingerprinting or custom headers — it requires real JavaScript execution.
Solution
api.anthropic.com hosts the same OAuth token endpoint at /v1/oauth/token but without the Cloudflare managed challenge:
curl -s -w "\n%{http_code}" -X POST \
-H "Content-Type: application/json" \
-d '{"grant_type":"authorization_code","client_id":"9d1c250a-e61b-44d9-88ed-5944d1962f5e","code":"test","state":"test","code_verifier":"test"}' \
"https://api.anthropic.com/v1/oauth/token"
# Returns: {"error": "invalid_grant", "error_description": "Invalid 'code' in request."} (real OAuth2 error, not Cloudflare)
# HTTP 400Fix: Change TokenURL in internal/auth/claude/anthropic_auth.go from console.anthropic.com to api.anthropic.com:
TokenURL = "https://api.anthropic.com/v1/oauth/token"
Tested locally with a patched build — login succeeds.
Environment
- CLIProxyAPI Version: 6.8.20
- OS: macOS (darwin/arm64)
- Go: 1.24.6
Bug Description
cliproxyapi -claude-loginfails with a 403 error during OAuth token exchange. The token endpoint athttps://console.anthropic.com/v1/oauth/tokenis protected by a Cloudflare managed challenge that requires JavaScript execution, making it impossible for any programmatic HTTP client (Go, curl, Python, etc.) to complete the request.Steps to Reproduce
The browser opens and OAuth authorization at
claude.aisucceeds, but the subsequent token exchange POST fails:The same 403 occurs with curl, confirming it's a server-side WAF rule (not a TLS/HTTP fingerprinting issue):
Root Cause
Cloudflare has enabled a managed challenge (
cType: 'managed') onconsole.anthropic.comthat blocks all non-browser requests to/v1/oauth/token. This cannot be bypassed with uTLS fingerprinting or custom headers — it requires real JavaScript execution.Solution
api.anthropic.comhosts the same OAuth token endpoint at/v1/oauth/tokenbut without the Cloudflare managed challenge:Fix: Change
TokenURLininternal/auth/claude/anthropic_auth.gofromconsole.anthropic.comtoapi.anthropic.com:Tested locally with a patched build — login succeeds.
Environment