Authenticating Claude Code in CI/CD: auth status & setup-token, tested live

The long-lived token flow for CI where browser login isn't available — run partway, live.

Local login vs CI/CD

On your own Mac you can just sign in via browser; CI pipelines and headless servers don't have one. Claude Code has a dedicated flow for that.

Run live on this Mac (personal fields masked):

$ claude auth status
{ "loggedIn": true, "authMethod": "claude.ai", "apiProvider": "firstParty",
  "subscriptionType": "max" }

`claude auth login` and `claude auth logout` (per `claude auth --help`) sign in/out and clear credentials.

Requires a Claude subscription. Run live, it showed (OAuth URL partly masked; we stopped before pasting a code):

$ claude setup-token
Opening browser to sign in…
https://claude.com/cai/oauth/authorize?code=true&client_id=***&...
Paste code here if prompted >

Per public sources (fetched 2026-07-29): set it as `CLAUDE_CODE_OAUTH_TOKEN`, valid for 1 year. We didn't complete the flow to actually mint one.

Treat it like a year-long password — store it in your CI's secret manager, never in the repo, and revoke via `claude auth logout` if it leaks.

How do I check if I'm logged in?

Run claude auth status — verified live, it returns a JSON with loggedIn/authMethod/subscriptionType.

How do I set up CI authentication?

Run claude setup-token — verified live up through the OAuth URL / paste-code prompt.

How is the issued token used?

Per public sources: set CLAUDE_CODE_OAUTH_TOKEN (valid 1 year). We didn't complete minting one in this test.

Does it work with GitHub Actions?

An official anthropics/claude-code-action reportedly exists (not verified here).

How should I handle the token?

As a long-lived secret — store it in your CI's secret manager, never in the repo.