Table of Contents

Has Claude Code suddenly thrown a message like this and demanded you log in?

Not logged in · Please run /login
Invalid API key · Fix external API key
Please run /login · API Error: 401 OAuth token has expired ...
API Error: 400 ... This organization has been disabled.

These are "authentication failed (who are you?)" errors, usually surfacing as 401/403. The frustrating part is how baffling they look — "I'm paying, yet I'm rejected" or "it worked yesterday, now it suddenly wants me to log in." But most causes are textbook, and once you know the order to check, it is a quick fix.

The most important point up front. (1) The number-one auth problem is an environment variable ANTHROPIC_API_KEY silently overriding your subscription (Pro/Max) login — which becomes the real cause of unexpected pay-as-you-go charges, "organization disabled," and "Invalid API key." (2) The starting point is always /status to see "which credential is active right now." (3) When in doubt, "unset the stray key → /logout → /login" for a clean re-entry.

CLAUDE CODE · AUTH PRECEDENCE

Credentials have a "precedence"

— the one higher up wins, so an env API key overrides your subscription

↑ Outside the list (above 1): if you are signed in to a Claude apps gateway, only its token is used (none of 1–7 is)
1 Cloud (Bedrock/Agent Platform (Vertex)/Foundry)
2 ANTHROPIC_AUTH_TOKEN (LLM gateways and proxies)
3 ANTHROPIC_API_KEY ← env var this wins = pay-as-you-go
4 apiKeyHelper
5 CLAUDE_CODE_OAUTH_TOKEN (claude setup-token)
6 Anthropic profiles and federation credentials (ant CLI, Workload Identity Federation)
A login profile such as one from ant auth login ranks here only when named in ANTHROPIC_PROFILE; otherwise it ranks below 7
7 Subscription OAuth (/login) what you actually want

If ANTHROPIC_API_KEY lingers in your environment, it takes precedence over the subscription.
First check with /status → if unneeded, unset ANTHROPIC_API_KEY.

1. What this error is telling you

Authentication means "proving who you are." Claude Code proves "you" with one credential, such as your subscription OAuth login, an API key, or cloud credentials. When that proof fails, you are rejected as 401 (authentication_error) or 403 (forbidden). The representative messages and meanings:

MessageMeaning
Not logged in · Please run /loginNo valid credential → /login
Invalid API key · Fix external API keyA key from an env var or apiKeyHelper was rejected by the API (if ANTHROPIC_API_KEY contains a line break or similar, Claude Code stops it before sending)
Your ANTHROPIC_API_KEY belongs to a disabled organization · …
API Error: 400 ... This organization has been disabled.		A stale ANTHROPIC_API_KEY from a disabled org is in use. If it appears with no env var set, the org behind your /login is the disabled one (see below the table)
OAuth token revoked · Please run /login
Please run /login · API Error: 401 OAuth token has expired ...		Signed out everywhere / an admin removed access (revoked); auto-refresh failed (expired)
API Error: 403 ... forbidden ... Request not allowedInactive subscription, missing Console role, or proxy interference

The disabled-organization message ends in one of two hints after the "·". Unset the environment variable to use your subscription instead means you still have a login saved with /login, so removing the key puts you back on your subscription. Update or unset the environment variable means the key is your only credential: remove it and run /login, or replace it with a key from an active organization. If no environment variable is set and the error keeps coming back, the disabled organization is the one tied to the account you signed in with through /login. The official error reference says to contact support or sign in with a different account.

The similar-looking Login expired · Please run /login is a different state from Not logged in, where there were never any credentials: the automatic refresh of your saved login was rejected, and Claude Code deleted the credentials. The request stops on your machine without being sent, so instead of retrying, sign in again with /login. For details, see what Login expired · Please run /login means and how to fix it.

The wording of Not logged in also depends on where you run it. In sessions that the Claude Desktop app runs, such as the Code tab or Cowork, it reads Authentication required · Sign in again to continue, and you sign in again from the app. According to the official error reference, if you sign in with your claude.ai account in another Claude Code window that uses the same configuration directory, an interactive session showing this message starts using that login on its own, with no restart needed. Older versions could leave the message behind, though. Per the official CHANGELOG, v2.1.281 (September 23, 2026) fixed the “Not logged in · Run /login” footer and missing claude.ai connectors persisting in a session after logging in from another Claude Code process, and v2.1.286 (September 30) fixed macOS sessions still showing Not logged in or Login expired after /login succeeded in another window when a leftover ~/.claude/.credentials.json existed. On macOS before v2.1.286, the official docs say to restart the session that shows the message.

When your organization's settings block subscription sign-in, you see a message that starts with Your organization has disabled Claude subscription access. It is not a problem with your local credentials, so running /login again with the same account does not fix it. What to do is covered in section 7.

The key habit: before blaming yourself, run /status to see "which credential is active right now." Most auth errors stem from an unintended credential being selected — and the prime suspect is the "API key override" in the next section.

2. The big trap — an API key overrides your subscription

The official docs state that Claude Code picks ONE credential by "precedence" (see the hero). The catch is that the environment variable ANTHROPIC_API_KEY sits ABOVE your subscription (Pro/Max) login. In other words —

The official explanation (paraphrased)

"Even with an active subscription, if ANTHROPIC_API_KEY is set in your environment, it takes precedence once approved. If that key belongs to a disabled or expired org, authentication fails. Run unset ANTHROPIC_API_KEY to fall back to your subscription, and check /status to confirm which is active."

This override produces three "baffling" symptoms. (1) Unexpected pay-as-you-go charges — what should be a flat subscription gets billed per token via the API key. (2) Your ANTHROPIC_API_KEY belongs to a disabled organization (or This organization has been disabled) — the leftover key belonged to a disabled old org. (3) Invalid API key — the key is expired or wrong. None of these is "a problem with your login" — they are "a problem of a stray key squatting in your environment." While this override is in effect, connectors you added on claude.ai are not loaded either, and you may see a warning that starts with claude.ai connectors are disabled. For details, see what claude.ai connectors are disabled means and how to fix it.

Where the key comes from: an export ANTHROPIC_API_KEY=... in ~/.zshrc / ~/.bashrc / ~/.profile; a .env read by direnv, dotenv, or your IDE terminal; a leftover from a previous job/project; a CI environment. On Windows, the PowerShell profile ($PROFILE) or User environment variables. Detect with /status and env | grep ANTHROPIC; fix with:

# Temporarily unset and launch
unset ANTHROPIC_API_KEY
claude

# Permanent fix: remove the export line from your shell config / .env, then confirm with /status

Note: in interactive mode you are asked once whether to use the key, and your choice is remembered (change it later via the "Use custom API key" toggle in /config, which appears only while ANTHROPIC_API_KEY is set). In non-interactive mode (-p), the key is always used when present, without asking. Unless you deliberately want to use the API key, confirm with /status that the subscription is active.

3. Other causes

Auth issues other than the override also tend to have fixed causes.

OTHER CAUSES

Auth stumbles beyond the override

Token revoked / expired
Signed out everywhere / an admin removed access / refresh failed. Re-enter with /logout → /login.
System clock skew
Token validation depends on accurate time. If you are asked to log in every launch, fix the clock.
macOS Keychain
With a locked Keychain / password mismatch, your login falls back to the plaintext ~/.claude/.credentials.json, and a Console login that creates an API key fails. Check with claude doctor.
Missing Console role (403)
For a Console account, confirm a "Claude Code" / "Developer" role; for Pro/Max, confirm the subscription is active.
OAuth in WSL/SSH/containers
The browser redirect cannot return locally. Paste the shown code, press c to copy the URL, or set BROWSER.
Org policy
Disabled subscription access is a server-side setting you cannot override locally (section 7). Disabled API key authentication can be fixed on your side: remove the key (or apiKeyHelper) and run /login.

"Asked to log in every time" → suspect clock skew or Keychain first.
"Rejected with 403" → suspect inactive subscription, Console role, or proxy.

Knowing where credentials live also speeds recovery. macOS: Keychain (falling back to the same file as Linux when the Keychain rejects the write); Linux: ~/.claude/.credentials.json (mode 0600); Windows: %USERPROFILE%\.claude\.credentials.json. /login and /logout manage this file. If something looks broken, use the official reset rather than deleting the file by hand: /logout → close Claude Code → start it again and /login. Logging out removes every stored credential, including saved MCP server logins and plugin secrets, so expect to re-authorize MCP servers and re-enter plugin secrets afterwards (official login and authentication troubleshooting).

4. The diagnostic workflow

When stuck on auth, go top-down. Most cases resolve by step 3.

DIAGNOSE

Isolate it top-down

1
/status to see which credential is active (subscription, API key, or cloud).
2
env | grep ANTHROPIC (Windows: $PROFILE / User env vars) to find a stray key.
3
unset ANTHROPIC_API_KEY → relaunch. Make it permanent by removing the export line from your shell config / .env.
4
Still failing? /logout → close Claude Code → /login for a clean re-auth.
5
Fix the clock / check the Keychain with claude doctor (macOS) / confirm your Console role (orgs).

The rule: "first /status, then hunt for the stray key."
Most cases are fixed by simply removing the key that was overriding you.

5. Telling it apart from similar errors

"Rejected / stopped" can have non-auth causes too. Splitting by the HTTP code is the reliable way.

SymptomWhat it really isMain fix
401 / 403 · Invalid API key · Not logged inThis article = auth (credential problem)/status → remove stray key → /login
usage limit reachedPlan quota exhausted (auth is fine)Wait for reset; fixes
429 Request rejectedRate limit (a low-tier key override can cause a 429)Slow down; also check /status for a stray key
529 / 500Server-side overload / internal errorWait & retry; fixes
Credit balance is too lowConsole prepaid balance exhausted, or requests going out on a Console API key when you meant to use your subscriptionAdd credits. To use your subscription, check the key in /status and unset it (run /login if not signed in)

A mnemonic: 401/403 is the "who are you?" problem = auth. usage limit and Credit balance are "amount / balance" problems. 429 is rate, 529/500 is server-side. Notably, a stray API key causes not just "auth failure" but also "unexpected charges," "a 429 on a low tier," and "Credit balance is too low" — which is why the answer to confusion is always /status first. The low-balance error itself is covered in Your credit balance is too low to access the Anthropic API: What It Means and How to Fix It. For other common errors, see the error roundup.

6. Prevention checklist

A checklist to stop getting stuck on auth repeatedly.

(1) If you use the subscription, do not leave ANTHROPIC_API_KEY in your shell config / .env (watch for leftovers from old jobs/projects). (2) Make a habit of /status to confirm the active credential before important work. (3) For CI, use claude setup-token's CLAUDE_CODE_OAUTH_TOKEN (or an explicit API key) instead of interactive login. (4) If you are asked to log in every time, check the system clock and the macOS Keychain. (5) For org accounts, confirm the Console role and plan status. (6) In WSL/SSH, know the paste-the-code method.

7. Your organization has disabled Claude subscription access — when your org blocks subscription sign-in

When you sign in to Claude Code with a subscription account, you may be stopped by this message:

Your organization has disabled Claude subscription access for Claude Code · Use an Anthropic API key instead, or ask your admin to enable access

It means the organization your account belongs to (your Claude organization) does not allow using Claude Code through a subscription login. Unlike the stray API key in section 2 or the expired token in section 3, the cause is not on your machine but in your organization's settings.

The official explanation (paraphrased)

"This is a server-side organization setting, so it cannot be overridden from local settings, environment variables, or CLI flags. Running /login again with the same account returns the same error. In non-interactive mode (-p) and the Agent SDK, it surfaces as the error code oauth_org_not_allowed."

The official docs list three ways forward, and which one fits depends on your role.

If you use it as a member of an organization — ask your admin to enable access

The first is to ask your admin to enable Claude Code access for your organization. There is no setting you can change on your side. When you ask, pass along the exact error text together with the account and organization that /status shows, so it is clear which organization's setting is involved. Note that the official error reference does not say which screen the admin uses to turn it on.

If you use an API key — authenticate with the Claude Console

The second is to authenticate with a Claude Console API key instead of your subscription. That is what "Use an Anthropic API key instead" in the message refers to. Setup follows the official Claude Console authentication steps, and you cannot finish it on your own:

  • A Console admin invites you from Settings → Members → Invite and assigns either the "Claude Code" role (can create only Claude Code API keys) or the "Developer" role (can create any kind of API key)
  • After accepting the invite, run /login in Claude Code and choose your Anthropic Console account to sign in. You can also launch Claude Code with a key created in the Console set in the ANTHROPIC_API_KEY environment variable (in interactive mode, you are asked once whether to use that key)
  • Run /status to confirm that the active credential is now the Console one

Two cautions. The first is cost: usage through the Console is billed as API usage charges, not against your subscription's included usage (the same mechanism as the "unexpected pay-as-you-go charges" in section 2, this time on purpose). The second is the reverse error: if the Console organization has turned off API key authentication, you get Your organization has disabled API key authentication instead (shown from v2.1.169). Its official fix is the reverse too — remove the key and run /login to sign in with your claude.ai account.

If you are the organization's admin

If you are the admin and do not see an option to enable access, the official docs tell you to contact Anthropic support.

Sources: the official Claude Code error reference (the entries for this error and for Your organization has disabled API key authentication), the Claude Console authentication section of the authentication docs, and the Claude Help Center article Use Claude Code with your Pro or Max plan (all checked on September 22, 2026).

Summary

Claude Code's auth/login errors (Not logged in / Invalid API key / organization disabled / OAuth token expired, etc.) are mostly 401/403 = credential problems. The most frequent true cause is "the environment variable ANTHROPIC_API_KEY silently overriding your subscription login" — which produces unexpected pay-as-you-go charges, organization disabled, and Invalid API key. So the starting point is always /status to see "which credential is active."

Diagnose by (1) /status -> (2) env | grep ANTHROPIC to hunt a stray key -> (3) unset + remove from shell config -> (4) /logout -> /login -> (5) clock / Keychain / Console role. Most cases are fixed by simply removing the key that was overriding you. Split by 401/403 = auth, usage limit / Credit = amount-balance, 429 = rate, 529/500 = server to avoid the wrong fix. Related: usage limit, 529/500 errors, Claude Code error roundup.

FAQ

Q. I'm paying, yet I get "Invalid API key" or "organization has been disabled." Why?
A. Usually, an environment variable ANTHROPIC_API_KEY is overriding your subscription login. If that key belongs to an expired or disabled org, you get rejected even with an active subscription. Find it with env | grep ANTHROPIC, run unset ANTHROPIC_API_KEY, then /login and confirm with /status. Also remove the export line from your shell config (.zshrc, etc.) or .env. If no environment variable is set and "organization disabled" keeps appearing, the disabled organization is the one behind your /login: contact support or sign in with a different account.

Q. I'm on a flat subscription but got billed per token.
A. This too is typically the ANTHROPIC_API_KEY override. When the API key takes precedence, usage flows to per-token API billing instead of your flat subscription. Confirm with /status that "the subscription is active"; if the API key is selected, remove it with unset + config cleanup. Keep it only if you intend to use the API key.

Q. I'm asked to log in every time I start.
A. The common causes are (1) system clock skew (token validation depends on accurate time) and (2) a locked macOS Keychain / password mismatch that blocks writes to the Keychain (your login then falls back to the plaintext ~/.claude/.credentials.json, and a Console login that creates an API key fails). Set the clock to auto-sync, and on macOS check the Keychain with claude doctor. If it persists, re-enter cleanly with /logout → /login.

Q. What does /status tell me?
A. It shows which authentication method/credential is currently active (subscription OAuth, ANTHROPIC_API_KEY, or cloud credentials). Since most auth trouble is "an unintended credential being selected," /status first is the rule. The exact display varies by version, so confirm current behavior in the official docs.

Q. Login fails over WSL or SSH because the browser does not open.
A. On remote setups, the browser redirect cannot return to the local callback. Work around it by pasting the login code Claude Code shows, pressing c to copy the URL and opening it in your local browser, or setting the BROWSER environment variable on WSL2. Knowing the paste-the-code method makes this reliable.