How to Invalidate a Claude Code setup-token (and What Works Today)

If you ran claude setup-token for a CI job and the token has now ended up in a log, a screenshot, or a repository, the question is simple: how do you kill it? The honest answer in October 2026 is that the command only mints tokens. It has no --list and no --revoke, and the feature requests asking for them were closed without a fix.

This guide covers what Anthropic documents, the manual revoke path, the reports that revocation does not always take effect, and a playbook you can run in about ten minutes.

TL;DR: revoking a setup-token token

Agents that act on your behalf need rules. Agentbeam stops the dangerous actions →

What claude setup-token actually creates

A vault door with a green key, showing how a claude setup-token token is a long-lived credential to store in a secret manager

Anthropic's authentication docs describe the command in one line: for CI pipelines, scripts, or other environments where interactive browser login is not available, you generate "a one-year OAuth token with claude setup-token".

The flow is the same browser authorization as /login. After you approve access, the token prints to your terminal. The docs add that it "does not save the token anywhere", so you copy it into whatever secret store your pipeline uses and expose it as the CLAUDE_CODE_OAUTH_TOKEN environment variable.

Three properties matter for security:

• It uses your subscription. The token needs a Pro, Max, Team or Enterprise plan. It is not an API key and it bills against subscription usage, not a Console balance.
• It is narrow. Anthropic says it "can only make model requests", so it cannot establish Remote Control sessions or fetch claude.ai connectors. MCP servers you configure locally still work.
• It outranks your normal login. In the credential precedence list, CLAUDE_CODE_OAUTH_TOKEN sits above the subscription login from /login. Docs note that if you run /login while the variable is set, Claude Code reads the variable again in every new session until you remove it from your shell profile or the env block of a settings file.

That last point is the most common reason a "revoked" credential seems to keep working on a laptop: the variable is still exported in a shell profile. For the full command and credential reference, see the Claude Code commands guide.

Why there is no revoke command

People have asked for one repeatedly, and all three requests ended without a feature:

In none of the three threads did an Anthropic maintainer reply; the only activity was from bots. The author of #48373 also noted that claude setup-token --help shows no options at all. So today the command is a one-way door: you can create tokens, but the tooling to manage them lives elsewhere.

The manual revoke path in claude.ai

The only management surface is the web app. Open claude.ai, then Settings, then Claude Code, and scroll to the Authorization tokens section. The page describes it as: "Created when you sign in to Claude Code. Revoke a token to sign out from that device."

Each entry shows three things:

The user:inference scope lines up with Anthropic's statement that a setup-token token "can only make model requests". Note what the screen does not show: there is no label saying which entry came from claude setup-token, which came from a laptop login, and which came from an IDE. The only clue is the connection time, so the cleanest way to find your CI token is to mint it, then look for the entry that appeared in the last few minutes.

Other limits of that screen, from the public threads:

1. Entries are hard to tell apart. A commenter on #59378 could not tell which of two same-scope tokens was which.
2. No bulk action. There is no "revoke all" button, and the related issue #56987 reports the list has no pagination.
3. The list can be long. One report says that with remoteControlAtStartup enabled, a new token is minted on every interactive session, so the list can grow to hundreds of entries.

The same settings page also has a separate control to permanently delete the copies of your Claude Code sessions that Anthropic stores. That deletes session history, not credentials, so it is not a substitute for revoking the token.

Does revoking actually work?

This is the part to be careful about. The long-running bug report #43801 tracks the claim that revoking sessions and Claude Code instances does not invalidate the underlying OAuth tokens. Its timeline is mixed:

• April 2026: the reporter found a token still worked after a VM sat offline for one to two weeks and sessions were revoked. By April 28 a re-test showed a re-auth prompt, so it looked fixed, though the reporter noted it was a short-cycle test with no changelog entry.
• July to August 2026: several users reported clicking revoke and seeing usage keep rising, or tokens still working.
• August 5, 2026: one tester presented a CLI setup-token token from a clean container after revoking it and got 401 OAuth access token has been revoked. Malformed tokens returned is invalid. The same tester found that re-running setup-token does not revoke the older token.
• August 23, 2026: a user whose account was compromised through an infostealer reported new authorization tokens kept appearing after revocation.

The thread was closed and locked on October 18, 2026 with no visible maintainer response, and users there said revocation still failed for them. Anthropic has not published a statement I could find that settles the question.

What to take from it: revocation of a setup-token token has been reported to work in at least one clean test, but you should never assume it did. Verify.

Leaked CLAUDE_CODE_OAUTH_TOKEN: a ten-minute playbook

Run these in order. They are a practical procedure built from the documented behavior above, not an Anthropic-published runbook.

1. Remove the token from where it is used

Delete it from the CI secret store, the shell profile, and any env block in a Claude Code settings file. Because the variable is re-read in every new session, leaving it behind keeps a stale credential winning over your normal login.

2. Revoke it in claude.ai

Open Settings, then Claude Code, find it under Authorization tokens and revoke it. Entries show only a connection time and scope, so if you cannot tell which one is yours, revoke every Claude Code entry created around the time you minted it, then re-authenticate the machines you still use. Revoking too much costs you a login; revoking too little leaves the leak live.

3. Prove the token is dead

On a machine or container that has never been logged in, set the old value and send one request:

CLAUDE_CODE_OAUTH_TOKEN='<old-token>' claude -p "say ok"

A reported revoked token returns an error mentioning that the token has been revoked. If you get an answer back, the revoke did not take effect, and you should treat the token as still live.

4. Check for use you did not make

Look at your usage in claude.ai for spikes after the leak time. The token spends subscription usage, so unexplained consumption is your signal that someone else used it.

5. If it still works, escalate

If the old token still answers after a revoke, or new authorizations keep appearing, change your account password, review your sign-in methods, and contact Anthropic support. Those are standard account-compromise steps, not steps the docs list for this command.

6. Mint a replacement, and store it properly

Run claude setup-token again, copy the value straight into your secret manager, and keep it out of build logs. Remember that this creates a second live token, so repeat step 2 for any older one you are replacing.

How to keep the next leak small

A small key ring with one key, showing the narrow scope a revocable Claude Code token should have

You cannot list or revoke by token ID, so the safest design is to assume you will need to rotate and make rotation cheap.

• Use a dedicated account or seat for CI. If you must revoke aggressively, you will not break your daily login.
• Schedule rotation. The token lasts a year, and a year is far too long for a credential pasted into a pipeline. Rotating quarterly is a team policy choice, not an Anthropic requirement.
• Prefer revocable keys where you can. If your pipeline can use a Claude Console API key instead, those are individually managed in the Console key list, which gives you the per-credential control setup-token lacks. The trade-off is that API keys bill against API usage rather than your subscription. See the Claude Code pricing guide for how the two compare.
• Never print it. Mask the variable in CI logs and do not echo it while debugging.
• Limit what the agent can do. A token only decides who is billed. What the agent does with shell access is a separate problem; the rm -rf incident guide and the security guidance plugin cover that side. AgentBeam, built by the explainx.ai team, is one option for stopping agents from running dangerous actions: agentbeam.com.

What this means for your CI

If you run Claude Code unattended, a setup-token token is a one-year bearer credential that you cannot inspect from the command line. Treat it like a long-lived deploy key. Keep one per pipeline, record where each lives, and write down the revoke-and-verify steps before you need them. The Claude Code CI/CD pipeline guide covers the pipeline side, and the loops guide covers scheduled runs that tend to hold these tokens.

For comparison, other tools handle subscription OAuth differently, as in the Codex ChatGPT login guide, and third-party harnesses that used setup-token flows are discussed in the OpenClaw subscription post.

What is still unknown

• No official revoke runbook. Anthropic's docs describe how to mint and use the token but, in the pages checked, not how to revoke it.
• Reliability is disputed. The reports above are user tests, not an Anthropic statement, and they conflict.
• No per-token labels. Whether the claude.ai list will ever show which entry came from setup-token is not announced.
• Organization limits. Anthropic's docs say claude setup-token enforces forceLoginMethod but not forceLoginOrgUUID, so it can mint a token in a different organization. Admins who rely on org restrictions should know that gap exists.

If any of this changes, this page will be updated.

Accurate as of October 26, 2026. Behavior of claude setup-token, the claude.ai settings screen and the linked issue threads can change; check the official authentication docs before acting.

Related reading

• Claude Code commands: complete reference
• Claude Code in CI/CD pipelines
• Claude Code pricing guide
• The Claude Code rm -rf incident and sandbox guide
• Claude Code security guidance plugin
• Claude Code loops: official guide
• Login with ChatGPT for Codex: OAuth explained
• Official: Claude Code authentication docs