How to Invalidate a Claude Code setup-token (and What Works Today)

Anthropic's `claude setup-token` command can only mint credentials, with no `--list` or `--revoke` option, and three feature requests asking for revocation tooling were closed without a fix, according to a guide published in October 2026. Tokens generated by the command last one year per Anthropic's authentication documentation, are not saved anywhere by the tool, and can only make model requests against a Pro, Max, Team or Enterprise subscription; users must revoke them manually at claude.ai under Settings, Claude Code, Authorization tokens. The guide notes one tester reports that re-running the command does not invalidate the old token, and recommends confirming a kill by sending a request with the old token from a clean machine and expecting a 401.

If you ran claude setup-token for a CI job and the token has now ended up in a log, a screenshot, or a repository, the question is simple: how do you kill it? The honest answer in October 2026 is that the command only mints tokens. It has no --list and no --revoke , and the feature requests asking for them were closed without a fix. This guide covers what Anthropic documents, the manual revoke path, the reports that revocation does not always take effect, and a playbook you can run in about ten minutes. TL;DR: revoking a setup-token token | Question | Answer | |---|---| | Is there a CLI command to revoke it? | No. claude setup-token is mint-only, per the open feature requests | | How long does the token last? | One year, per Anthropic's authentication docs | | Where do I revoke it by hand? | claude.ai, Settings, Claude Code, Authorization tokens one entry per token, no label for setup-token | | Does the command save the token for me? | No. Anthropic says it "does not save the token anywhere" | | What can a leaked token do? | Make model requests on your subscription. No Remote Control, no claude.ai connectors | | Does re-running the command kill the old token? | One tester reports it does not | | How do I confirm the kill? | Send one request with the old token from a clean machine and expect a 401 | Agents that act on your behalf need rules. Agentbeam stops the dangerous actions → https://app.agentbeam.com/login What claude setup-token actually creates A vault door with a green key, showing how a claude setup-token token is a long-lived credential to store in a secret manager Anthropic's authentication docs https://code.claude.com/docs/en/authentication?ref=explainx describe the command in one line: for CI pipelines, scripts, or other environments where interactive browser login is not available, you generate "a one-year OAuth token with claude setup-token ". The flow is the same browser authorization as /login . After you approve access, the token prints to your terminal. The docs add that it "does not save the token anywhere", so you copy it into whatever secret store your pipeline uses and expose it as the CLAUDE CODE OAUTH TOKEN environment variable. Three properties matter for security: - It uses your subscription. The token needs a Pro, Max, Team or Enterprise plan. It is not an API key and it bills against subscription usage, not a Console balance. - It is narrow. Anthropic says it "can only make model requests", so it cannot establish Remote Control sessions or fetch claude.ai connectors. MCP servers you configure locally still work. - It outranks your normal login. In the credential precedence list, CLAUDE CODE OAUTH TOKEN sits above the subscription login from /login . Docs note that if you run /login while the variable is set, Claude Code reads the variable again in every new session until you remove it from your shell profile or the env block of a settings file. That last point is the most common reason a "revoked" credential seems to keep working on a laptop: the variable is still exported in a shell profile. For the full command and credential reference, see the Claude Code commands guide https://explainx.ai/blog/claude-code-commands-complete-reference-guide-2026 . Why there is no revoke command People have asked for one repeatedly, and all three requests ended without a feature: | Issue | What it asked for | Outcome | |---|---|---| | 48373 April 15, 2026 | claude setup-token --list and --revoke <token-id , so a compromised sandbox token could be killed within about five minutes | Closed as a duplicate on April 18, locked April 30 | | 57400 May 8, 2026 | A revoke command, with the use case "what if token gets leaked" | Closed as not planned on June 26, locked August 29 | | 59378 May 15, 2026 | Auto-expiry, a "revoke all" button, and an API to list and revoke tokens | Closed as not planned on July 20, locked September 16 | In none of the three threads did an Anthropic maintainer reply; the only activity was from bots. The author of 48373 also noted that claude setup-token --help shows no options at all. So today the command is a one-way door: you can create tokens, but the tooling to manage them lives elsewhere. The manual revoke path in claude.ai The only management surface is the web app. Open claude.ai, then Settings, then Claude Code , and scroll to the Authorization tokens section. The page describes it as: "Created when you sign in to Claude Code. Revoke a token to sign out from that device." Each entry shows three things: | Field | Example from the live page | |---|---| | Application | Claude Code | | When it was created | "Connected 16 minutes ago" | | Scope | user:inference | The user:inference scope lines up with Anthropic's statement that a setup-token token "can only make model requests". Note what the screen does not show: there is no label saying which entry came from claude setup-token , which came from a laptop login, and which came from an IDE. The only clue is the connection time, so the cleanest way to find your CI token is to mint it, then look for the entry that appeared in the last few minutes. Other limits of that screen, from the public threads: 1. Entries are hard to tell apart. A commenter on 59378 could not tell which of two same-scope tokens was which. 2. No bulk action. There is no "revoke all" button, and the related issue 56987 reports the list has no pagination. 3. The list can be long. One report says that with remoteControlAtStartup enabled, a new token is minted on every interactive session, so the list can grow to hundreds of entries. The same settings page also has a separate control to permanently delete the copies of your Claude Code sessions that Anthropic stores. That deletes session history, not credentials, so it is not a substitute for revoking the token. Does revoking actually work? This is the part to be careful about. The long-running bug report 43801 https://github.com/anthropics/claude-code/issues/43801?ref=explainx tracks the claim that revoking sessions and Claude Code instances does not invalidate the underlying OAuth tokens. Its timeline is mixed: - April 2026: the reporter found a token still worked after a VM sat offline for one to two weeks and sessions were revoked. By April 28 a re-test showed a re-auth prompt, so it looked fixed, though the reporter noted it was a short-cycle test with no changelog entry. - July to August 2026: several users reported clicking revoke and seeing usage keep rising, or tokens still working. - August 5, 2026: one tester presented a CLI setup-token token from a clean container after revoking it and got 401 OAuth access token has been revoked . Malformed tokens returned is invalid . The same tester found that re-running setup-token does not revoke the older token. - August 23, 2026: a user whose account was compromised through an infostealer reported new authorization tokens kept appearing after revocation. The thread was closed and locked on October 18, 2026 with no visible maintainer response, and users there said revocation still failed for them. Anthropic has not published a statement I could find that settles the question. What to take from it: revocation of a setup-token token has been reported to work in at least one clean test, but you should never assume it did. Verify. Leaked CLAUDE CODE OAUTH TOKEN: a ten-minute playbook Run these in order. They are a practical procedure built from the documented behavior above, not an Anthropic-published runbook. 1. Remove the token from where it is used Delete it from the CI secret store, the shell profile, and any env block in a Claude Code settings file. Because the variable is re-read in every new session, leaving it behind keeps a stale credential winning over your normal login. 2. Revoke it in claude.ai Open Settings, then Claude Code, find it under Authorization tokens and revoke it. Entries show only a connection time and scope, so if you cannot tell which one is yours, revoke every Claude Code entry created around the time you minted it, then re-authenticate the machines you still use. Revoking too much costs you a login; revoking too little leaves the leak live. 3. Prove the token is dead On a machine or container that has never been logged in, set the old value and send one request: CLAUDE CODE OAUTH TOKEN='<old-token ' claude -p "say ok" A reported revoked token returns an error mentioning that the token has been revoked. If you get an answer back, the revoke did not take effect, and you should treat the token as still live. 4. Check for use you did not make Look at your usage in claude.ai for spikes after the leak time. The token spends subscription usage, so unexplained consumption is your signal that someone else used it. 5. If it still works, escalate If the old token still answers after a revoke, or new authorizations keep appearing, change your account password, review your sign-in methods, and contact Anthropic support. Those are standard account-compromise steps, not steps the docs list for this command. 6. Mint a replacement, and store it properly Run claude setup-token again, copy the value straight into your secret manager, and keep it out of build logs. Remember that this creates a second live token, so repeat step 2 for any older one you are replacing. How to keep the next leak small A small key ring with one key, showing the narrow scope a revocable Claude Code token should have You cannot list or revoke by token ID, so the safest design is to assume you will need to rotate and make rotation cheap. - Use a dedicated account or seat for CI. If you must revoke aggressively, you will not break your daily login. - Schedule rotation. The token lasts a year, and a year is far too long for a credential pasted into a pipeline. Rotating quarterly is a team policy choice, not an Anthropic requirement. - Prefer revocable keys where you can. If your pipeline can use a Claude Console API key instead, those are individually managed in the Console key list, which gives you the per-credential control setup-token lacks. The trade-off is that API keys bill against API usage rather than your subscription. See the Claude Code pricing guide https://explainx.ai/blog/claude-code-pricing-guide-2026 for how the two compare. - Never print it. Mask the variable in CI logs and do not echo it while debugging. - Limit what the agent can do. A token only decides who is billed. What the agent does with shell access is a separate problem; the rm -rf incident guide https://explainx.ai/blog/claude-code-rm-rf-reddit-incident-sandbox-guide-august-2026 and the security guidance plugin https://explainx.ai/blog/claude-code-security-guidance-plugin-2026 cover that side. AgentBeam, built by the explainx.ai team, is one option for stopping agents from running dangerous actions: agentbeam.com https://agentbeam.com/?ref=explainx . What this means for your CI If you run Claude Code unattended, a setup-token token is a one-year bearer credential that you cannot inspect from the command line. Treat it like a long-lived deploy key. Keep one per pipeline, record where each lives, and write down the revoke-and-verify steps before you need them. The Claude Code CI/CD pipeline guide https://explainx.ai/blog/claude-code-cicd-pipeline-guide-2026 covers the pipeline side, and the loops guide https://explainx.ai/blog/claude-code-loops-official-guide-turn-goal-schedule-2026 covers scheduled runs that tend to hold these tokens. For comparison, other tools handle subscription OAuth differently, as in the Codex ChatGPT login guide https://explainx.ai/blog/login-with-chatgpt-codex-subscription-oauth-2026 , and third-party harnesses that used setup-token flows are discussed in the OpenClaw subscription post https://explainx.ai/blog/openclaw-chatgpt-plus-pro-openai-anthropic-subscription-2026 . What is still unknown - No official revoke runbook. Anthropic's docs describe how to mint and use the token but, in the pages checked, not how to revoke it. - Reliability is disputed. The reports above are user tests, not an Anthropic statement, and they conflict. - No per-token labels. Whether the claude.ai list will ever show which entry came from setup-token is not announced. - Organization limits. Anthropic's docs say claude setup-token enforces forceLoginMethod but not forceLoginOrgUUID , so it can mint a token in a different organization. Admins who rely on org restrictions should know that gap exists. If any of this changes, this page will be updated. Accurate as of October 26, 2026. Behavior of claude setup-token, the claude.ai settings screen and the linked issue threads can change; check the official authentication docs before acting.