The token expires

[exclipy]

I set this up last night and it worked great, but this morning, I'm getting this error:

"result": "API Error: 401 {"type":"error","error":{"type":"authentication_error","message":"OAuth token has expired. Please obtain a new token or refresh your existing token."}}",

Is this expected? Do I just need to keep pasting in a new token to GitHub Secrets every time?

[grll]

Yes I observed the same unfortunately as the token expires at the expires at you can predict for how long you will be able to use it. I thought the Claude SDK would use the refresh token to create a new valid token in this case but it seems it is not setup in the GitHub action...

There are 2 possible fixes:

1. The proper fix would be to use the refresh token to get a new valid token and expires at in the GitHub action we would need to see how Claude Code does it..
2. A simpler temporary fix could be to have a script that automatically read your credentials and create the secrets on your GitHub repository for you

[jordandakota]

Working on making a playwright enabled script that does the oauth flow and runs claude login and then picks up the tokens.

[grll]

Working on making a playwright enabled script that does the oauth flow and runs claude login and then picks up the tokens.

I was working on it yesterday as well I found the following:

You can refresh the token by making a POST request console.anthropic.com/v1/oauth/token. So we could put that in the github action to refresh the token everytime before actually runny the claude code action:

#!/usr/bin/env python3

import json
import time
from pathlib import Path
import httpx

TOKEN_URL = 'https://console.anthropic.com/v1/oauth/token'
CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e'
CREDENTIALS_PATH = Path.home() / '.claude' / '.credentials.json'

def refresh():
    # Read credentials
    with open(CREDENTIALS_PATH) as f:
        creds = json.load(f)['claudeAiOauth']
    
    # Check if refresh needed (5 min threshold)
    if time.time() * 1000 + 300000 < creds['expiresAt']:
        print('Token still valid')
        return
    
    # Refresh token
    resp = httpx.post(TOKEN_URL, json={
        'grant_type': 'refresh_token',
        'refresh_token': creds['refreshToken'],
        'client_id': CLIENT_ID
    })
    result = resp.json()
    
    # Update credentials
    creds['accessToken'] = result['access_token']
    creds['refreshToken'] = result.get('refresh_token', creds['refreshToken'])
    creds['expiresAt'] = int(time.time() * 1000) + (result['expires_in'] * 1000)
    
    # Save
    CREDENTIALS_PATH.parent.mkdir(parents=True, exist_ok=True)
    with open(CREDENTIALS_PATH, 'w') as f:
        json.dump({'claudeAiOauth': creds}, f)
    
    print('Token refreshed')

if __name__ == '__main__':
    refresh()

Note that: The CLIENT_ID seems to be hardcoded in claude code cli.js I tried to npm install several claude code and it came with the same CLIENT_ID it seems.

The issue now is that this will produce a new refresh token and access token that needs to be updated in the github secrets. Which would require to pass a github token to the action with appropriate right to do so.

Also your local claude might become out of sync with that so I am not sure how it would handle multiple claude state re-authenticating. Although today I am using claude on my linux computer and my mac and it seems to works fine so it could work.

I think the simplest solution would still remain to write a small script that reads .credential.json or keychain on macOS and use gh to set secrets on your repository. You would have to run that script every 8 hours unfortunately.

[nimishchaudhari]

Thanks for this OAuth based action @grll .

I have an input, I noticed that if I take my wsl's credentials and put it on github actions, it works for the day, except if I open my WSL's claude command, in which case both the WSL and Github secrets expire and request for a re-login.

[khayashida919]

+1

[grll]

Thanks for this OAuth based action @grll .

I have an input, I noticed that if I take my wsl's credentials and put it on github actions, it works for the day, except if I open my WSL's claude command, in which case both the WSL and Github secrets expire and request for a re-login.

Thanks for the input yes that's probably because if you have several session with several Claude in different place I guess if one of them expire and refresh the token all of the other need to refresh the token. Usually this is not really an issue as the Claude code app in interactive mode does the refresh for you. But it seems in non interactive mode it doesn't.

Note that it seems tokens are valid for 8 hours

[dvcrn]

I think a solution is to use caching on github actions:

• Run claude, do the work
• Claude will refresh the tokens
• Store updated tokens in github actions cache (cache ~/.claude/credentials.json)

On next run:

• If cache exists -> try use that first as the token is updated
• If cache doesn't exist -> use secret

[grll]

I think a solution is to use caching on github actions:

• Run claude, do the work
• Claude will refresh the tokens
• Store updated tokens in github actions cache (cache ~/.claude/credentials.json)

On next run:

• If cache exists -> try use that first as the token is updated
• If cache doesn't exist -> use secret

Hi @dvcrn thanks a lot for the suggestion, I think caching it could be useful indeed.

But to my understanding the issue was more that Claude Code when ran in non interactive mode is not even trying to refresh the token. I shared some investigation above that could help us do that though.

Have you tried to cache the credentials.json, did it work for you?

[jordandakota]

Claude code in non interactive mode absolutely does not refresh the token. Have max+, ran script every 10 mins for 8 hrs, failed after expiry.

…

________________________________ From: Guillaume Raille ***@***.***> Sent: Tuesday, June 3, 2025 11:32:29 PM To: grll/claude-code-action ***@***.***> Cc: Jordan Fox ***@***.***>; Comment ***@***.***> Subject: Re: [grll/claude-code-action] The token expires (Issue #2) Caution: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. [https://avatars.githubusercontent.com/u/1738060?s=20&v=4]grll left a comment (grll/claude-code-action#2)<#2 (comment)> I think a solution is to use caching on github actions: * Run claude, do the work * Claude will refresh the tokens * Store updated tokens in github actions cache (cache ~/.claude/credentials.json) On next run: * If cache exists -> try use that first as the token is updated * If cache doesn't exist -> use secret Hi @dvcrn<https://github.com/dvcrn> thanks a lot for the suggestion, I think caching it could be useful indeed. But to my understanding the issue was more that Claude Code when ran in non interactive mode is not even trying to refresh the token. I shared some investigation above that could help us do that though. Have you tried to cache the credentials.json, did it work for you? — Reply to this email directly, view it on GitHub<#2 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AHXVCFJXTG3BD6YO5FVA5SD3B2AG3AVCNFSM6AAAAAB6BS2LAKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDSMZYGYZDONBRGY>. You are receiving this because you commented.Message ID: ***@***.***>

[dvcrn]

But to my understanding the issue was more that Claude Code when ran in non interactive mode is not even trying to refresh the token. I shared some investigation above that could help us do that though.

How about spawning claude in interactive mode once at the beginning/end of the session to refresh the token, then killing it after 5-10 seconds?

For another project, I manually wrote the .claude/settings.json and .claude.json files to mark a project as already opened

eg

  "hasCompletedOnboarding": true,
  "hasIdeOnboardingBeenShown": true,

[grll]

But to my understanding the issue was more that Claude Code when ran in non interactive mode is not even trying to refresh the token. I shared some investigation above that could help us do that though.

How about spawning claude in interactive mode once at the beginning/end of the session to refresh the token, then killing it after 5-10 seconds?

For another project, I manually wrote the .claude/settings.json and .claude.json files to mark a project as already opened

eg

"hasCompletedOnboarding": true,
"hasIdeOnboardingBeenShown": true,

Interesting idea, I will try when I get a minute

[amondnet]

I use a github action to renew the token once an hour. When the token is renewed, the action modifies the organization secret. This requires a PAT with write access to the organization secret.

GH_TOKEN: ${{ secrets.ORG_TOKEN }}

name: Update Claude OAuth Token

on:
  schedule:
    - cron: '0 * * * *'
  workflow_dispatch: # 수동 실행 가능
    inputs:
      force:
        description: 'Force token refresh regardless of expiration'
        required: false
        default: false
        type: boolean
jobs:
  update-token:
    runs-on: ubuntu-latest
    env:
      TOKEN_URL: https://console.anthropic.com/v1/oauth/token
      CLIENT_ID: 9d1c250a-e61b-44d9-88ed-5944d1962f5e
      ACCESS_TOKEN: ${{ secrets.CLAUDE_ACCESS_TOKEN }}
      REFRESH_TOKEN: ${{ secrets.CLAUDE_REFRESH_TOKEN }}
      EXPIRES_AT: ${{ secrets.CLAUDE_EXPIRES_AT }}
      
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
    - name: Check token expiration
      id: check-expiration
      run: |
        CURRENT_TIME_MS=$(date +%s000)
        
        echo "Current time: $CURRENT_TIME_MS"
        echo "Token expires at: $EXPIRES_AT"
        
        # 1시간 임계값으로 갱신 필요 여부 체크
        THRESHOLD=$((CURRENT_TIME_MS + 3600000))
        
        # Force 옵션이 활성화된 경우 무조건 갱신
        if [ "${{ github.event.inputs.force }}" = "true" ]; then
          echo "Force refresh requested"
          echo "TOKEN_VALID=false" >> $GITHUB_OUTPUT
        elif [ "$THRESHOLD" -lt "$EXPIRES_AT" ]; then
          echo "Token still valid"
          echo "TOKEN_VALID=true" >> $GITHUB_OUTPUT
        else
          echo "Token needs refresh within 1 hour, refreshing..."
          echo "TOKEN_VALID=false" >> $GITHUB_OUTPUT
        fi
                
    - name: Refresh Claude Token
      id: refresh
      if: steps.check-expiration.outputs.TOKEN_VALID == 'false'
      run: |
        # 토큰 갱신 요청 (curl 사용)
        RESPONSE=$(curl -s -w "HTTPSTATUS:%{http_code}" -X POST "$TOKEN_URL" \
          -H "Content-Type: application/json" \
          -d "{
            \"grant_type\": \"refresh_token\",
            \"refresh_token\": \"$REFRESH_TOKEN\",
            \"client_id\": \"$CLIENT_ID\"
          }")
        
        # HTTP 상태 코드와 응답 분리
        HTTP_STATUS=$(echo $RESPONSE | tr -d '\n' | sed -e 's/.*HTTPSTATUS://')
        RESPONSE_BODY=$(echo $RESPONSE | sed -e 's/HTTPSTATUS:.*//g')
        
        if [ "$HTTP_STATUS" -ne 200 ]; then
          echo "Error: HTTP $HTTP_STATUS"
          echo "Response: $RESPONSE_BODY"
          exit 1
        fi
        
        # JSON 응답에서 토큰 정보 추출
        NEW_ACCESS_TOKEN=$(echo "$RESPONSE_BODY" | jq -r '.access_token')
        NEW_REFRESH_TOKEN=$(echo "$RESPONSE_BODY" | jq -r '.refresh_token // empty')
        EXPIRES_IN=$(echo "$RESPONSE_BODY" | jq -r '.expires_in')

        # 필수 필드 검증
        if [ -z "$NEW_ACCESS_TOKEN" ] || [ "$NEW_ACCESS_TOKEN" = "null" ]; then
          echo "Error: Failed to extract access token from response"
          exit 1
        fi
        
        if [ -z "$EXPIRES_IN" ] || [ "$EXPIRES_IN" = "null" ]; then
          echo "Error: Failed to extract expires_in from response"
          exit 1
        fi

        CURRENT_TIME_MS=$(date +%s000)

        # 새 만료 시간 계산 (현재 시간 + expires_in * 1000)
        NEW_EXPIRES_AT=$((CURRENT_TIME_MS + (EXPIRES_IN * 1000)))
        
        # 새 refresh_token이 없으면 기존 것 유지 (원본 로직과 동일)
        if [ "$NEW_REFRESH_TOKEN" = "null" ] || [ -z "$NEW_REFRESH_TOKEN" ]; then
          NEW_REFRESH_TOKEN="$REFRESH_TOKEN"
        fi
        
        echo "Token refreshed successfully"
        echo "New token expires at: $NEW_EXPIRES_AT"
        
        # GitHub Actions outputs 설정
        echo "TOKEN_REFRESHED=true" >> $GITHUB_OUTPUT
        echo "::add-mask::$NEW_ACCESS_TOKEN"
        echo "NEW_ACCESS_TOKEN=$NEW_ACCESS_TOKEN" >> $GITHUB_OUTPUT
        echo "::add-mask::$NEW_REFRESH_TOKEN"
        echo "NEW_REFRESH_TOKEN=$NEW_REFRESH_TOKEN" >> $GITHUB_OUTPUT
        echo "NEW_EXPIRES_AT=$NEW_EXPIRES_AT" >> $GITHUB_OUTPUT
        
        
    - name: Update GitHub Secrets
      if: steps.refresh.outputs.TOKEN_REFRESHED == 'true'
      run: |
        echo "Updating GitHub secrets..."
        
        # 토큰 값 검증 후 업데이트
        if [ -n "${{ steps.refresh.outputs.NEW_ACCESS_TOKEN }}" ]; then
          gh secret set CLAUDE_ACCESS_TOKEN --body "${{ steps.refresh.outputs.NEW_ACCESS_TOKEN }}" --org "${{ github.repository_owner }}"
          echo "Access token updated"
        else
          echo "Error: New access token is empty"
          exit 1
        fi
        
        if [ -n "${{ steps.refresh.outputs.NEW_REFRESH_TOKEN }}" ]; then
          gh secret set CLAUDE_REFRESH_TOKEN --body "${{ steps.refresh.outputs.NEW_REFRESH_TOKEN }}" --org "${{ github.repository_owner }}"
          echo "Refresh token updated"
        else
          echo "Error: New refresh token is empty"
          exit 1
        fi
        
        if [ -n "${{ steps.refresh.outputs.NEW_EXPIRES_AT }}" ]; then
          gh secret set CLAUDE_EXPIRES_AT --body "${{ steps.refresh.outputs.NEW_EXPIRES_AT }}" --org "${{ github.repository_owner }}"
          echo "Expires at updated"
        else
          echo "Error: New expires at is empty"
          exit 1
        fi
        
        echo "GitHub secrets updated successfully"
      env:
        GH_TOKEN: ${{ secrets.ORG_TOKEN }}
        
    - name: Log token status
      run: |
        if [ "${{ steps.refresh.outputs.TOKEN_REFRESHED }}" == "true" ]; then
          echo "✅ Token was renewed"
          # 새 만료 시간을 사람이 읽기 쉬운 형태로 표시
          NEW_EXPIRES_SECONDS=$((${{ steps.refresh.outputs.NEW_EXPIRES_AT }} / 1000))
          echo "🕐 New expiration: $(date -d @$NEW_EXPIRES_SECONDS)"
        else
          echo "ℹ️ Token is still valid, no renewal needed"
          # 현재 만료 시간을 사람이 읽기 쉬운 형태로 표시
          CURRENT_EXPIRES_SECONDS=$((${{ secrets.CLAUDE_EXPIRES_AT }} / 1000))
          echo "🕐 Current expiration: $(date -d @$CURRENT_EXPIRES_SECONDS)"
        fi
        
    - name: Notify on failure
      if: failure()
      run: |
        echo "❌ Claude OAuth token refresh failed!"
        # 필요시 Slack 등으로 알림 전송
        # curl -X POST -H 'Content-type: application/json' \
        #   --data '{"text":"Claude OAuth token refresh failed!"}' \
        #   ${{ secrets.SLACK_WEBHOOK_URL }}

[grll]

I use a github action to renew the token once an hour. When the token is renewed, the action modifies the organization secret. This requires a PAT with write access to the organization secret.

GH_TOKEN: ${{ secrets.ORG_TOKEN }}

name: Update Claude OAuth Token

on:
schedule:
- cron: '0 * * * *'
workflow_dispatch: # 수동 실행 가능
inputs:
force:
description: 'Force token refresh regardless of expiration'
required: false
default: false
type: boolean
jobs:
update-token:
runs-on: ubuntu-latest
env:
TOKEN_URL: https://console.anthropic.com/v1/oauth/token
CLIENT_ID: 9d1c250a-e61b-44d9-88ed-5944d1962f5e
ACCESS_TOKEN: ${{ secrets.CLAUDE_ACCESS_TOKEN }}
REFRESH_TOKEN: ${{ secrets.CLAUDE_REFRESH_TOKEN }}
EXPIRES_AT: ${{ secrets.CLAUDE_EXPIRES_AT }}

steps:
- name: Checkout repository
  uses: actions/checkout@v4
- name: Check token expiration
  id: check-expiration
  run: |
    CURRENT_TIME_MS=$(date +%s000)
    
    echo "Current time: $CURRENT_TIME_MS"
    echo "Token expires at: $EXPIRES_AT"
    
    # 1시간 임계값으로 갱신 필요 여부 체크
    THRESHOLD=$((CURRENT_TIME_MS + 3600000))
    
    # Force 옵션이 활성화된 경우 무조건 갱신
    if [ "${{ github.event.inputs.force }}" = "true" ]; then
      echo "Force refresh requested"
      echo "TOKEN_VALID=false" >> $GITHUB_OUTPUT
    elif [ "$THRESHOLD" -lt "$EXPIRES_AT" ]; then
      echo "Token still valid"
      echo "TOKEN_VALID=true" >> $GITHUB_OUTPUT
    else
      echo "Token needs refresh within 1 hour, refreshing..."
      echo "TOKEN_VALID=false" >> $GITHUB_OUTPUT
    fi
            
- name: Refresh Claude Token
  id: refresh
  if: steps.check-expiration.outputs.TOKEN_VALID == 'false'
  run: |
    # 토큰 갱신 요청 (curl 사용)
    RESPONSE=$(curl -s -w "HTTPSTATUS:%{http_code}" -X POST "$TOKEN_URL" \
      -H "Content-Type: application/json" \
      -d "{
        \"grant_type\": \"refresh_token\",
        \"refresh_token\": \"$REFRESH_TOKEN\",
        \"client_id\": \"$CLIENT_ID\"
      }")
    
    # HTTP 상태 코드와 응답 분리
    HTTP_STATUS=$(echo $RESPONSE | tr -d '\n' | sed -e 's/.*HTTPSTATUS://')
    RESPONSE_BODY=$(echo $RESPONSE | sed -e 's/HTTPSTATUS:.*//g')
    
    if [ "$HTTP_STATUS" -ne 200 ]; then
      echo "Error: HTTP $HTTP_STATUS"
      echo "Response: $RESPONSE_BODY"
      exit 1
    fi
    
    # JSON 응답에서 토큰 정보 추출
    NEW_ACCESS_TOKEN=$(echo "$RESPONSE_BODY" | jq -r '.access_token')
    NEW_REFRESH_TOKEN=$(echo "$RESPONSE_BODY" | jq -r '.refresh_token // empty')
    EXPIRES_IN=$(echo "$RESPONSE_BODY" | jq -r '.expires_in')

    # 필수 필드 검증
    if [ -z "$NEW_ACCESS_TOKEN" ] || [ "$NEW_ACCESS_TOKEN" = "null" ]; then
      echo "Error: Failed to extract access token from response"
      exit 1
    fi
    
    if [ -z "$EXPIRES_IN" ] || [ "$EXPIRES_IN" = "null" ]; then
      echo "Error: Failed to extract expires_in from response"
      exit 1
    fi

    CURRENT_TIME_MS=$(date +%s000)

    # 새 만료 시간 계산 (현재 시간 + expires_in * 1000)
    NEW_EXPIRES_AT=$((CURRENT_TIME_MS + (EXPIRES_IN * 1000)))
    
    # 새 refresh_token이 없으면 기존 것 유지 (원본 로직과 동일)
    if [ "$NEW_REFRESH_TOKEN" = "null" ] || [ -z "$NEW_REFRESH_TOKEN" ]; then
      NEW_REFRESH_TOKEN="$REFRESH_TOKEN"
    fi
    
    echo "Token refreshed successfully"
    echo "New token expires at: $NEW_EXPIRES_AT"
    
    # GitHub Actions outputs 설정
    echo "TOKEN_REFRESHED=true" >> $GITHUB_OUTPUT
    echo "::add-mask::$NEW_ACCESS_TOKEN"
    echo "NEW_ACCESS_TOKEN=$NEW_ACCESS_TOKEN" >> $GITHUB_OUTPUT
    echo "::add-mask::$NEW_REFRESH_TOKEN"
    echo "NEW_REFRESH_TOKEN=$NEW_REFRESH_TOKEN" >> $GITHUB_OUTPUT
    echo "NEW_EXPIRES_AT=$NEW_EXPIRES_AT" >> $GITHUB_OUTPUT
    
    
- name: Update GitHub Secrets
  if: steps.refresh.outputs.TOKEN_REFRESHED == 'true'
  run: |
    echo "Updating GitHub secrets..."
    
    # 토큰 값 검증 후 업데이트
    if [ -n "${{ steps.refresh.outputs.NEW_ACCESS_TOKEN }}" ]; then
      gh secret set CLAUDE_ACCESS_TOKEN --body "${{ steps.refresh.outputs.NEW_ACCESS_TOKEN }}" --org "${{ github.repository_owner }}"
      echo "Access token updated"
    else
      echo "Error: New access token is empty"
      exit 1
    fi
    
    if [ -n "${{ steps.refresh.outputs.NEW_REFRESH_TOKEN }}" ]; then
      gh secret set CLAUDE_REFRESH_TOKEN --body "${{ steps.refresh.outputs.NEW_REFRESH_TOKEN }}" --org "${{ github.repository_owner }}"
      echo "Refresh token updated"
    else
      echo "Error: New refresh token is empty"
      exit 1
    fi
    
    if [ -n "${{ steps.refresh.outputs.NEW_EXPIRES_AT }}" ]; then
      gh secret set CLAUDE_EXPIRES_AT --body "${{ steps.refresh.outputs.NEW_EXPIRES_AT }}" --org "${{ github.repository_owner }}"
      echo "Expires at updated"
    else
      echo "Error: New expires at is empty"
      exit 1
    fi
    
    echo "GitHub secrets updated successfully"
  env:
    GH_TOKEN: ${{ secrets.ORG_TOKEN }}
    
- name: Log token status
  run: |
    if [ "${{ steps.refresh.outputs.TOKEN_REFRESHED }}" == "true" ]; then
      echo "✅ Token was renewed"
      # 새 만료 시간을 사람이 읽기 쉬운 형태로 표시
      NEW_EXPIRES_SECONDS=$((${{ steps.refresh.outputs.NEW_EXPIRES_AT }} / 1000))
      echo "🕐 New expiration: $(date -d @$NEW_EXPIRES_SECONDS)"
    else
      echo "ℹ️ Token is still valid, no renewal needed"
      # 현재 만료 시간을 사람이 읽기 쉬운 형태로 표시
      CURRENT_EXPIRES_SECONDS=$((${{ secrets.CLAUDE_EXPIRES_AT }} / 1000))
      echo "🕐 Current expiration: $(date -d @$CURRENT_EXPIRES_SECONDS)"
    fi
    
- name: Notify on failure
  if: failure()
  run: |
    echo "❌ Claude OAuth token refresh failed!"
    # 필요시 Slack 등으로 알림 전송
    # curl -X POST -H 'Content-type: application/json' \
    #   --data '{"text":"Claude OAuth token refresh failed!"}' \
    #   ${{ secrets.SLACK_WEBHOOK_URL }}

Wonderful that's also what I had in mind! I will try if we cannot use claude interactive mode + cache as it would be way simpler for us but if it doesnt work this would be my go to.

[grll]

But to my understanding the issue was more that Claude Code when ran in non interactive mode is not even trying to refresh the token. I shared some investigation above that could help us do that though.

How about spawning claude in interactive mode once at the beginning/end of the session to refresh the token, then killing it after 5-10 seconds?

For another project, I manually wrote the .claude/settings.json and .claude.json files to mark a project as already opened

eg

"hasCompletedOnboarding": true,
"hasIdeOnboardingBeenShown": true,

So I have tried that creating both files and opening in claude with pseudo tty in interactive mode. It correclty opens, however it does not seem to refresh the token just by opening. I thought maybe you need to send some command to it or prompts but then after many attempts I couldnt figure out a way to "press enter" (send the command in pseudo tty). I tried with \n, \r, hex equivalent of \n \r, printf, expect, socat...

Nothing worked expect tmux locally but tmux also requires a TTY / terminal which wouldnt work in github ci...

@dvcrn or anyone else I don't know if you have other ideas or if I am doing something wrong?

[dvcrn]

@grll let me play a bit around and see if I can get something working locally