termdeck
Claude Code fix: Claude Code looks signed out on an idle machine
A subscription access token lasts hours and is renewed by the CLI, not by anything watching it. On a machine nobody has started a session on lately, that difference shows up as a login that looks dead and is not.
Comes from Claude Code.
Diagnosis
The access token in ~/.claude/.credentials.json is renewed when Claude Code runs. Anything that reads the file without running the CLI sees an expired token and reports what it saw, which is why a model picker can go empty on a box whose login is perfectly good.
The refresh token rotates, so a value replayed by two writers gets the account revoked outright. Nudging the CLI to refresh its own credential is the safe move, and doing the refresh on its behalf is the unsafe one.
A machine left alone for long enough passes that one too. At that point the login is genuinely over and only a fresh sign-in helps.
Check
| Run this | What a good answer looks like |
|---|---|
claude auth status | Runs the CLI, which renews the credential as a side effect, and prints what it concludes: whether it is logged in, and by which method. |
ls -l ~/.claude/.credentials.json | The modification time is the last refresh. A file untouched for days on a machine you thought was busy is the tell. |
Every command here has been run on a real machine. Termdeck answers the same questions for every machine you have connected, without opening a terminal on any of them.
Fix
One status call is enough to renew a lapsed access token. It is also exactly what a well-behaved tool does instead of refreshing on the CLI behalf.
When the CLI itself cannot renew, there is nothing left to preserve and a sign-in is the whole fix.
A key in the environment or in a settings file takes priority over the subscription login and produces a similar-looking set of symptoms with a different cause.
Not this
It works, and it throws away a refresh token that would have renewed on its own. Run the CLI first and keep the sign-in in reserve.
FAQ
Fetching models needs a working credential. An expired token fails that fetch, and an empty picker is the visible half of an auth problem.
The access token lasts hours and the refresh token behind it much longer. Ordinary use renews both without anyone noticing.
Yes. Any run refreshes the credential, which is why a busy machine never shows this.
Claude Code, Codex and Grok in one browser console