Auto-refresh expired OAuth token instead of showing an HTTP error - #30
Open
dvdstelt wants to merge 1 commit into
Open
Auto-refresh expired OAuth token instead of showing an HTTP error#30dvdstelt wants to merge 1 commit into
dvdstelt wants to merge 1 commit into
Conversation
The indicator read claudeAiOauth.accessToken from .credentials.json and sent it as-is. OAuth access tokens are short-lived, so once the stored token expired the panel showed an HTTP error (401) until the Claude Code CLI happened to rewrite the file. Refresh the token in-extension using the refreshToken: check expiresAt before fetching and refresh proactively, and also retry once on a 401. On success the rotated access/refresh tokens and new expiry are written back to .credentials.json (mode kept at 0600) so the CLI stays in sync. Token endpoint and client_id match the Claude Code OAuth flow.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The indicator reads
claudeAiOauth.accessTokenfrom.credentials.jsonand sends it as-is to the usage endpoint. OAuth access tokens are short-lived, so once the stored token expires the panel just showsHTTP 401until the Claude Code CLI happens to run and rewrite the file. If you haven't used the CLI in a while, the indicator sits in an error state.For me, this is an issue because I use Claude Desktop all the time instead of the CLI.
Fix
Refresh the token in-extension using the
refreshTokenthat's already in the credentials file:expiresAtbefore fetching and refresh proactively (60s buffer)401in case the expiry metadata is staleaccessToken/refreshToken/expiresAtback to.credentials.json(file mode kept at0600) so the Claude Code CLI stays in sync on its next runThe token endpoint (
https://console.anthropic.com/v1/oauth/token) andclient_idmatch the Claude Code OAuth flow.Notes for reviewer
.credentials.json, a file the CLI also owns. That's intentional (keeps both in sync via refresh-token rotation), but flagging it for your review.client_idare the documented Claude Code OAuth values, not an official public API — worth being aware of if Anthropic changes the flow.