OAuth Token Lost Between Sessions
After successfully authenticating with OAuth during a Claude Code session, the token is lost when starting a new session. Users are forced to re-authenticate every time they run Claude Code, defeating the purpose of persistent authentication.
This commonly occurs when the agent doesn't properly serialize session state or when the token storage mechanism isn't configured for persistence across CLI invocations.
Error Messages You Might See
Common Causes
- Session token stored in memory-only structures instead of persistent storage (files or database)
- Token refresh mechanism not triggered before token expiration
- Missing environment variable or config file for token persistence path
- Session directory permissions preventing write/read operations
- Token encryption/decryption logic failing silently on reload
How to Fix It
Implement a token store using a local file (e.g., ~/.claude-code/tokens.json) with proper encryption. Add a token refresh check at CLI startup. Ensure the session directory exists with correct permissions (700). Test token round-trip serialization with unit tests.
Real developers can help you.
You don't need to be technical. Just describe what's wrong and a verified developer will handle the rest.
Get HelpFrequently Asked Questions
Where should OAuth tokens be stored?
Store encrypted tokens in a platform-specific config directory (~/.claude-code on Unix, %APPDATA% on Windows). Never commit tokens to version control.
How often should tokens be refreshed?
Check token expiration at CLI startup and refresh if within 10 minutes of expiry. Implement automatic refresh during long-running sessions.
What encryption should be used for stored tokens?
Use AES-256-GCM encryption with a key derived from a system keychain or master password stored securely.