Preflight Checklist
Problem Statement
When using Claude Code in devcontainers for security reasons (no host mounts), a new OAuth token is issued on every container creation. Currently, neither claude logout nor closing a devcontainer in VS Code revokes the token server-side. Local credentials (~/.claude/.credentials.json or macOS Keychain via VS Code extension) are removed or abandoned, but the server-side token remains valid for up to 4 days.
Additionally, the VS Code extension and CLI store credentials in different locations (VS Code secret storage / macOS Keychain vs ~/.claude/.credentials.json), meaning a claude logout in the terminal does not necessarily affect the token held by the VS Code extension, and vice versa.
The only current workaround is to manually visit claude.ai/settings/claude-code and revoke tokens one by one — which is impractical for frequent devcontainer workflows.
As a result, orphaned valid tokens accumulate server-side with each container lifecycle, which is a security concern.
Proposed Solution
claude logout should call Anthropic's token revocation endpoint server-side, immediately invalidating the token
Closing a devcontainer in VS Code (or any container shutdown event) should also trigger server-side token revocation for any tokens associated with that session
The CLI and VS Code extension should share a unified logout mechanism so that logging out from either invalidates all associated tokens
A scriptable revocation mechanism should be provided so that devcontainer shutdown hooks can automate this process
Alternative Solutions
No response
Priority
High - Significant impact on productivity
Feature Category
CLI commands and flags
Use Case Example
No response
Additional Context
No response
Preflight Checklist
Problem Statement
When using Claude Code in devcontainers for security reasons (no host mounts), a new OAuth token is issued on every container creation. Currently, neither claude logout nor closing a devcontainer in VS Code revokes the token server-side. Local credentials (~/.claude/.credentials.json or macOS Keychain via VS Code extension) are removed or abandoned, but the server-side token remains valid for up to 4 days.
Additionally, the VS Code extension and CLI store credentials in different locations (VS Code secret storage / macOS Keychain vs ~/.claude/.credentials.json), meaning a claude logout in the terminal does not necessarily affect the token held by the VS Code extension, and vice versa.
The only current workaround is to manually visit claude.ai/settings/claude-code and revoke tokens one by one — which is impractical for frequent devcontainer workflows.
As a result, orphaned valid tokens accumulate server-side with each container lifecycle, which is a security concern.
Proposed Solution
claude logout should call Anthropic's token revocation endpoint server-side, immediately invalidating the token
Closing a devcontainer in VS Code (or any container shutdown event) should also trigger server-side token revocation for any tokens associated with that session
The CLI and VS Code extension should share a unified logout mechanism so that logging out from either invalidates all associated tokens
A scriptable revocation mechanism should be provided so that devcontainer shutdown hooks can automate this process
Alternative Solutions
No response
Priority
High - Significant impact on productivity
Feature Category
CLI commands and flags
Use Case Example
No response
Additional Context
No response