Claude (Temporarily) Unable to Authenticate: Outage or Local Fix?

When Claude says it is unable to authenticate you, the exact wording tells you who produced the message, and that decides the next move:

• Temporarily unable to authenticate. Please retry. or Authentication service was unavailable. You can try again. Anthropic's service could not confirm your session. Check status.claude.com, stay signed in, and retry every few minutes. Nothing on your machine clears these while the service is failing.
• A Claude Code message that names /login, such as Login expired · Please run /login, or a script that stops with Failed to authenticate: .... Your saved credential is no longer valid. Run /status to see which credential is active, then /login or fix that credential.
• An error during sign-in itself, such as OAuth error: Invalid code in the terminal or "Unable to access Claude Code" in the browser. The sign-in flow or the account you signed in with is the problem, not your existing session.
• Your account is on hold, a 401 Invalid authentication credentials that comes back after /login, or a message about your organization. The account or organization is blocking you. Signing in again does not change it; the hold page or your admin does.

The one move to avoid until you know which case you are in is signing out. It is the documented reset when no incident is posted and the cause is unclear. During an authentication incident it turns a working session into a locked-out one: on September 29, 2026, Anthropic's status page told users, "If you're signed in, please don't sign out."

Which Claude authentication message do you have, and who sent it?

"Authenticate" in these messages rarely means a wrong password. It means a service or client could not confirm a session or credential you already have. Read the message on your screen against this table before changing anything.

Only the first two rows are about Anthropic's side. The rest name a cause on your machine, in your sign-in, or in your account, and each has its own fix further down. If your screen shows one of the first two rows, the table's job is to stop you from applying the fixes in the other rows.

"Temporarily unable to authenticate" comes from Anthropic, not you

The same holds for its sibling, "Authentication service was unavailable. You can try again." Three facts set these two sentences apart from everything else in the table.

They are not Claude Code's own messages. As of October 5, 2026, a byte search of the Claude Code 2.1.286 binary (the build bundled with Claude Desktop on macOS) finds neither sentence, and Claude Desktop's app bundle does not contain them either. The same binary does contain Claude Code's own sign-in strings, such as Failed to authenticate, OAuth error, Invalid code, and Paste code here. Neither sentence appears in the Claude Code error reference either. The reasonable conclusion is that the text comes from Anthropic's service and every client relays it as received, which is why the same words show up on the web and in the terminal. Anthropic has not documented which backend component sends them.

They track authentication incidents. "Temporarily unable to authenticate. Please retry." spread across the US, Europe, and the Middle East within the same hour on September 29, 2026, with outage trackers counting more than 10,000 reports during an incident Anthropic posted for claude.ai, Claude Code, Cowork, and the Claude API. "Authentication service was unavailable. You can try again." was reported in a Hacker News "Claude Is Down" thread at 22:00 and 22:06 UTC on August 16, 2026, inside the 21:58–22:34 UTC window of Anthropic's incident about users authenticating to claude.ai, Claude Code, and Cowork. One of those commenters said logging out and back in returned the same error. Users have also reported the second sentence in the Claude Desktop app and its Code tab.

They are not a verdict on your account. A suspended account gets a different message with a claude.ai/restricted link, and re-login does not clear it. Fear of a ban was the most common reaction in community threads on September 29; the follow-ups described the sentence clearing on its own when the incident ended.

Two smaller points help when reading the screen. The counter after the toast, such as (x6) in the "Please retry" toast on claude.ai, counts how many times the same message has appeared; it is not an attempt limit. And "Please retry" is the service's suggestion, separate from Claude Code's Retrying in Ns · attempt x/y countdown, which the spinner shows while the client re-sends a request on its own. Which retry class these sentences fall into is not documented, so if no countdown appears, the retry is yours to make.

Network failures are a separate class. Unable to connect to API, ENOTFOUND, and Couldn't connect through your proxy (ERR_PROXY_TUNNEL) mean your request never reached Anthropic; the authentication sentences mean it did. The guide Claude Code Unable to Connect to API: Fix ECONNREFUSED, ECONNRESET, and Proxy Errors covers that class.

Should you sign out and back in? The rule for /logout

Sign out only when all three of these hold:

1. No incident is posted on status.claude.com for claude.ai, Claude Code, or Cowork, and the message has persisted past the first 20 minutes or so (the status page can lag behind the first reports, as explained below).
2. The message does not already name a different fix. Login expired has cleared your credentials already, so /login alone is enough. An API key row in /status means the key, not the login, is the problem. An account hold or an Enterprise access message needs the hold page or an Owner.
3. Sign-in or the session keeps failing and the cause is not obvious. This is the case Claude Code's Troubleshoot installation and login page covers with its reset: run /logout, close Claude Code, start claude, and sign in again.

Do not sign out while an authentication incident is posted or while the two server-side sentences are spreading across other users. Sign-in is the broken part during those incidents, so signing out leaves you waiting for the very service that is down. The cost is also larger than it looks:

• /logout in Claude Code removes every stored credential, including saved MCP server logins and plugin secrets. You will re-authorize MCP servers and re-enter plugin secrets afterwards.
• "Log out of all active sessions" in claude.ai (Settings → Account → Log Out, web only) forces a fresh sign-in on every device. Web sessions normally last 28 days and refresh hourly with activity, according to the Claude Help Center article on logging out of all active sessions, so there is no reason to reset them during an outage.

To re-authenticate Claude Code once signing out is right, /login is the command; /logout first is only part of the full reset. If the browser does not open, press c to copy the sign-in URL.

Is Claude authentication down right now? Four signals

Work through these in order. Each one either settles the case or hands you to the next.

Signal 1: an incident on status.claude.com

status.claude.com lists claude.ai, Claude Console (platform.claude.com), the Claude API, Claude Code, Claude Cowork, and Claude for Government as separate components. The old address status.anthropic.com redirects there. An active incident on claude.ai, Claude Code, or Cowork that mentions sign-in, authentication, sessions, or elevated errors puts you in the incident case, and the local checks can wait.

The status page can trail the first reports. On September 29, 2026, Anthropic's first "Investigating" entry is stamped 14:21 UTC, while the impact window it reported later began at 14:00 UTC. If the page is green but one of the two server-side sentences started within the last 20 minutes and you changed nothing locally, treat it as a probable incident: wait ten minutes and reload the status page before touching credentials. A thread with hundreds of replies in r/ClaudeCode or r/ClaudeAI within the first hour is a reliable enough sign that the cause is not on your machine.

The status page also offers an Atom feed at https://status.claude.com/history.atom and email, SMS, Slack, Teams, and webhook subscriptions. As of October 5, 2026, its history shows no sign-in or authentication incident after September 29.

Signal 2: what Claude Code's /status shows

Run /status in Claude Code. It shows which credential is active: a Login method row for a claude.ai login, or an Auth token or API key row that names an environment variable. Three readings move you out of the incident case:

• A Login row reading Expired — log in again (Claude Code 2.1.210 or later). The saved login can no longer be renewed, and only /login clears it.
• An API key row that is not marked as not in use. An approved ANTHROPIC_API_KEY outranks your subscription login, so /login does not replace it.
• An Auth token row reading CLAUDE_CODE_OAUTH_TOKEN. Claude Code keeps sending that token even after it fails, so the token itself needs replacing.

In the VS Code extension, Check Your Claude Code Account in VS Code: Status, Login, and API Route shows where the same rows appear.

Signal 3: were you already signed in, or signing in?

On September 29, 2026, the two halves of the incident behaved differently. Existing conversations were "mostly working again" from 14:36 UTC, while a second issue kept blocking sign-in, single sign-on, Sign in with Apple, new chats, voice, file uploads, purchases, and new Claude Code or Cowork sessions until 14:59 UTC. That explains the mixed reports from the same hour: some people saw the toast repeat and still got responses, some found Claude Code working while the app failed, and some saw the reverse. A surface that could keep using an existing session kept going; one that needed a new session did not.

If you are signed in anywhere during an incident, that session is the most valuable thing you have. Keep it.

Signal 4: which credential path you use

Claude Code picks a credential in a fixed order: cloud-provider credentials (Bedrock, Vertex, Foundry) first, then ANTHROPIC_AUTH_TOKEN, then ANTHROPIC_API_KEY, then an apiKeyHelper script, then CLAUDE_CODE_OAUTH_TOKEN, then Anthropic profiles, and finally the subscription login from /login. Only the subscription login and a CLAUDE_CODE_OAUTH_TOKEN generated with claude setup-token rely on your claude.ai account. One community remark on September 29 noted that a Bedrock-based Claude integration kept working; that is a single report, but it fits the precedence list. If you authenticate with an API key or a cloud provider and still see an authentication failure, the subscription incident is not your cause, and the Claude Code sections below apply.

During an auth incident: stay signed in and retry slowly

Anthropic's instruction on September 29, 2026 was specific: "If you're signed in, please don't sign out." The same reasoning holds for any incident whose status text mentions sign-in or sessions.

Do not:

• Run /logout in Claude Code, or use "Log out of all active sessions" in claude.ai.
• Delete ~/.claude/.credentials.json, clear the macOS Keychain entry, or reinstall Claude Code or the desktop app. None of these touches the cause, and each one leaves you needing a fresh sign-in.
• Refresh the page or re-send the same prompt in a tight loop. Anthropic's incident text said retrying "may succeed," which is a reason to retry occasionally, not continuously.

Do:

• Keep the session open. In Claude Code, your original message stays in the conversation, so when the service recovers you can type try again instead of pasting a long prompt back in.
• Retry every few minutes. If a retry returns a normal response, keep working; some users reported the toast repeating in the corner while responses still arrived.
• Pause long, tool-heavy Claude Code tasks until the status page turns green. One user claimed that tool-calling retries during the incident used up their usage window quickly. That claim is unverified, and the only quota statement in Claude Code's error reference concerns 529 overload errors, which do not count against usage. Pausing costs nothing while the service is down anyway.
• Note the time the message first appeared. You will need it for the recovery check.

How long Claude authentication incidents have lasted

Anthropic's status history shows three authentication incidents in six weeks, with these impact windows:

Expect minutes to an hour, not a day. The August 16 incident is the one where "Authentication service was unavailable" was reported; September 29 produced "Temporarily unable to authenticate." Both wordings can return in a future incident, and the same rule covers them.

After recovery: check which messages and files were saved

Recovery is announced on the status page, not by the toast disappearing. On September 29, 2026, the Monitoring update at 15:11 UTC said most services had recovered as of 14:59 UTC and that "signing in, starting new chats, voice conversations, Claude Code and Cowork sessions, purchases and file uploads are working again." It also said: "Some messages sent between 14:00 and 14:59 UTC may not have been saved."

Once the page reports normal operation:

1. In claude.ai, open the conversations you used during the incident and confirm your last messages are there. If the last exchange is missing, send it again; the model has no memory of a message that was never stored.
2. In Claude Code, check the working tree, not the chat. Run git status and git diff to see which files the session actually changed. A turn cut off mid-way may have finished some tool calls and not others, and the files are a more reliable record than the transcript.
3. If a session refused to start during the incident, start it now.
4. If you did sign out, sign in again now. If Claude Code then shows a different message, such as Login expired or Couldn't save your login, the next section applies.

Claude Code says "Login expired" or "Failed to authenticate": fix the credential

With no incident posted, or with Claude Code showing one of its own messages, the cause is a credential on your machine. Each message below has a documented cause and fix in the Claude Code error reference.

Login expired, Not logged in, and OAuth token revoked

Login expired · Please run /login. Claude Code tried to renew your saved claude.ai login, the OAuth service rejected the stored refresh token, and Claude Code cleared the credentials. Run /login; retrying without it shows the same message on every request. If this happens often, check that your system clock is accurate, because token validation depends on correct timestamps. Within three days of expiry, Claude Code warns at startup with Your login expires in 3 days · run /login to renew; renewing then keeps background and Remote Control sessions from stopping when the login lapses.

Not logged in · Please run /login. No credential is available. Run /login, or, if you expected an environment variable to sign you in, check that it is exported in the shell that launched claude. In the Desktop app's Code tab or Cowork, the same state reads Authentication required · Sign in again to continue, and you sign in again from the app.

OAuth token revoked · Please run /login or Please run /login · API Error: 401 OAuth token has expired .... The API rejected the token. Revoked means you signed out everywhere or an admin removed access; expired means the automatic refresh failed mid-session. Run /login.

"Failed to authenticate" in claude -p and Agent SDK scripts

In non-interactive mode (claude -p) and the Agent SDK, the same failures arrive with a Failed to authenticate prefix and the structured error code authentication_failed:

• Failed to authenticate: OAuth token revoked. Please log in again or contact your administrator.
• Failed to authenticate. API Error: 401 OAuth token has expired ...
• Failed to authenticate: OAuth session expired and could not be refreshed (the script form of Login expired)

On versions before 2.1.287, the revoked message reads Your account does not have access to Claude. Please login again or contact your administrator. It means the same thing.

A script cannot complete a browser sign-in. Run claude in the same environment, finish /login, and rerun the script. For automation that should not depend on an interactive login, authenticate with ANTHROPIC_API_KEY or a long-lived token generated with claude setup-token. Keep in mind that in -p mode an ANTHROPIC_API_KEY in the environment is always used when present, so a forgotten key there wins over your login. Claude Code API Billing vs Subscription: API Key, Credits, or Pro/Max? explains which of the two pays for the work.

If the script uses CLAUDE_CODE_OAUTH_TOKEN, Claude Code keeps sending that value after a 401 instead of switching to a saved login. Generate a fresh token with claude setup-token and restart with it, or unset the variable and run /login.

401 Invalid authentication credentials

Please run /login · API Error: 401 Invalid authentication credentials is not an expired token. The API recognized the credential's format but rejected the account or organization behind it: the credential was recently revoked, the organization was disabled or removed your access, or the account was deactivated. Start with /status:

• An API key row that is in use: an approved ANTHROPIC_API_KEY takes precedence over your login, so /login does not replace it. Rotate the key in the Claude Console, or fall back to your subscription with unset ANTHROPIC_API_KEY (PowerShell: Remove-Item Env:ANTHROPIC_API_KEY).
• Only your login: run /login once. If the same message returns for the same account, the account or organization is no longer active, and your organization admin is the one who can restore access.
• ANTHROPIC_BASE_URL pointing at an LLM gateway: the text after 401 is the gateway's message, not Anthropic's, and /login does not change it. Fix the credential the gateway expects.

An API key you forgot about

A leftover ANTHROPIC_API_KEY in ~/.zshrc, ~/.bashrc, ~/.profile, or the Windows $PROFILE overrides your subscription once approved. A key from a former employer or an old project typically shows up as This organization has been disabled. Run unset ANTHROPIC_API_KEY, start claude again, and delete the export line so it stays gone; /status should then show only your login.

Organization settings produce their own messages. Your organization has disabled API key authentication means a Console admin turned off API keys, so unset the key and sign in with your claude.ai account. Your organization has disabled Claude subscription access means the reverse: use an API key or ask the admin to enable access. Invalid API key and Claude login not accepted · Run /login, then try again each have their own entries in the Claude Code error reference.

Could not refresh your login, or Couldn't save your login

Could not refresh your login because another Claude Code process is refreshing it. Another Claude Code process on the same machine holds the shared refresh lock, or exited and left it behind. This does not mean your login was rejected. Wait a minute; if it recurs, close other Claude Code windows; if it recurs with nothing else running, run /login, which does not wait on the lock.

Couldn't save your login on macOS, or repeated prompts to log in. The login Keychain rejected the write, which happens when it is locked in an SSH session or after sleep, or when its password is out of sync with your account password. Claude Code then falls back to the plaintext ~/.claude/.credentials.json. Run claude doctor from the shell: a warning starting with macOS Keychain is not writable confirms it. Unlock with security unlock-keychain ~/Library/Keychains/login.keychain-db, run claude doctor again, and once the warning is gone, run /login.

For failures that arrive as an HTTP status rather than a sentence, Claude Code API Error 500 or 529: Resume Without Duplicating Work covers a 500 during sign-in, and Claude Code 403, 503, and 529 Errors: Find the Source, Then Fix covers 403 Request not allowed after a successful login.

Sign-in fails before Claude Code gets a login

These messages appear while you are signing in, so there is no existing session to protect and retrying the sign-in is safe.

OAuth error: Invalid code. Please make sure the full code was copied. The login code expired or was cut off when pasted. Press Enter to retry and finish the sign-in quickly after the browser opens. If the browser does not open, press c to copy the full URL. On a remote machine, the browser may have opened on the wrong computer; open the copied URL in your local browser instead.

WSL2, SSH, or a container. The browser runs on a different host, so its redirect cannot reach Claude Code's local callback. After you sign in, the browser shows a login code instead; paste it at the Paste code here if prompted prompt. In WSL2, if no browser opens, set the BROWSER environment variable to your Windows browser's path. If pasting does nothing, try the terminal's alternate paste (often right-click or Shift+Insert in Windows Terminal), or run claude auth login, which reads the pasted code from standard input.

Failed to start OAuth callback server. Claude Code could not open its local callback port, so no sign-in URL appears at all. If Claude Code runs inside a sandbox, check that the sandbox allows listening on local ports, then run /login again. To sign in right away, run claude setup-token on a machine where sign-in works and set the printed token as CLAUDE_CODE_OAUTH_TOKEN here, or use an API key from the Claude Console.

"Unable to access Claude Code" in the browser. After the sign-in appears to succeed, the browser shows "There was an issue accessing Claude Code. Try signing out and back in, or contact support if the problem persists." This text is not in the Claude Code binary; it comes from the sign-in page. Anthropic has not documented its cause, but the open anthropics/claude-code GitHub issue #19280 about this message points to two account-side causes, mostly for Team plan members who can still use claude.ai:

• The browser was signed in to a different Claude account than intended, such as an organization account without a Claude Code seat, and the sign-in quietly authorized that account. One commenter fixed it by signing out of claude.ai in the browser, or using a private window, and signing in with the right account.
• The member's seat in the Team organization was not assigned. Commenters report that an admin changing the seat from "Unassigned" back to a standard seat (Admin Settings → Organization → Members), or removing the member and inviting them again, fixed it.

Both are community reports, not documented fixes. Switching browsers, devices, or install methods did not help the reporters, so skip those.

Authorization failed with Claude Code access has not been granted for this account. Contact your administrator. Your Claude Enterprise organization set your role to Custom, and none of the custom roles assigned to your groups grants Claude Code. Nothing in Claude Code fixes this. An organization Owner has to assign a custom role that includes Claude Code, or switch you to a standard role such as User; then run claude and sign in again.

Signing in to claude.ai on the web or in the apps

The web, desktop, and mobile apps have fewer knobs. If a server-side sentence persists for you alone with no incident posted, sign out on one device only, sign back in with the same method (Google login or the emailed login link), and check whether the message follows you to a private browser window. If it does, the problem is most likely on the account side, and the Get help entry in claude.ai is the route Anthropic documents for account problems. Keep "Log out of all active sessions" as the last step, not the first. Phone or identity verification during sign-up is a separate process; none of the messages here is about it.

Account holds and region blocks are different messages

An account hold shows Your account is on hold and can't use Claude Code (or can't sign in to Claude Code when it is reported at sign-in) with a claude.ai/restricted link, in Claude Code and on the web alike. The hold is on the account, not the login, so retrying and signing in again change nothing. Open the link to read the details or appeal. In scripts, the structured error code is account_on_hold.

A region block appears when you connect from a country or region that is not on Anthropic's supported-countries list, and its wording is about location, not authentication. Some users on September 29 saw a region message and the authentication sentence within minutes of each other, because a change in network route produced the first and the incident produced the second. They are unrelated, and Anthropic's supported-countries page is the authoritative list for the first.

When to escalate: /feedback, Get help, or your admin

Escalate when one of these holds:

• No incident is posted, and a server-side sentence has persisted for more than an hour on more than one surface (for example, both the web app and Claude Code) after the checks above came back clean. In Claude Code, run /feedback; it sends a report with your session context after a consent screen. In claude.ai, sign in, click your initials in the lower left, and choose Get help.
• The message points at your organization: 401 Invalid authentication credentials returning for the same login, an organization message, "Unable to access Claude Code" on a Team or Enterprise account, or Claude Code access has not been granted. Seats, roles, and organization access are controlled by your organization admin or Owner, so start there.
• The message points at your account: the on-hold notice. Use its claude.ai/restricted link.

Skip /feedback while an incident is live. The status page already shows what Anthropic knows, and one more report will not bring the fix sooner.

Frequently asked questions

How do I fix "unable to authenticate" in Claude? Match the wording first. For "Temporarily unable to authenticate" or "Authentication service was unavailable," check status.claude.com, stay signed in, and retry every few minutes. For a Claude Code message that names /login, run /status and then /login. For "Unable to access Claude Code" in the browser or an Enterprise access message, check which account you signed in with and ask your admin.

Does "Temporarily unable to authenticate" mean my Claude account was banned? No. A suspended account gets a different message that includes a claude.ai/restricted link and does not clear on re-login. The authentication sentence reached users across several regions within the same hour on September 29, 2026, and Anthropic reported sign-in and sessions working again from 14:59 UTC.

Should I log out of Claude and log back in? Not while status.claude.com shows an incident touching claude.ai, Claude Code, or Cowork. Anthropic asked users during the September 29, 2026 incident not to sign out, because sign-in was the broken part. Once the page is green, the message persists only for you, and it does not name a more specific fix, one sign-out and sign-in on one device is the documented reset.

How do I re-authenticate Claude Code? Run /login inside Claude Code; /logout is not required first. If the browser does not open, press c to copy the sign-in URL. On WSL2, SSH, or in a container, paste the code the browser shows at Paste code here if prompted, or run claude auth login. A -p script needs you to run claude and complete /login in the same environment, or an API key or a claude setup-token token.

Why does Claude Code still work while the app shows the error, or the other way around? The two halves of an authentication incident affect different things. On September 29, 2026, existing conversations were mostly working from 14:36 UTC while new sign-ins and new Claude Code or Cowork sessions kept failing until 14:59 UTC. A surface that could reuse an existing session kept going; one that needed a new session did not.

Did the retries during the incident use up my Claude usage? Anthropic has not documented it either way for authentication errors. The only quota statement in the Claude Code error reference is for 529 overload errors, which do not count against usage. A community claim that tool-calling retries burned a usage window is unverified. Pausing long tasks until recovery is the safe choice.

Is Claude authentication down right now? status.claude.com is the source that also tells you when an incident is over and whether messages may have been lost. It lists claude.ai, the Claude API, Claude Code, Cowork, and the Console separately. In the first 20 minutes of an incident, community threads can show the problem before the status page does.