claude-oauth.json

{
  "extends": "default",
  "meta": {
    "name": "claude-oauth",
    "description": "Claude Code OAuth profile for login and normal sessions. Captures OAuth token responses and persists only nono phantom tokens in the sandbox."
  },
  "groups": {
    "include": [
      {
        "name": "claude_code_macos",
        "when": "macos"
      },
      {
        "name": "claude_code_linux",
        "when": "linux"
      },
      {
        "name": "user_caches_macos",
        "when": "macos"
      },
      {
        "name": "claude_cache_linux",
        "when": "linux"
      },
      "node_runtime",
      "python_runtime",
      "git_config",
      "unlink_protection"
    ]
  },
  "filesystem": {
    "allow": [
      "$HOME/.claude",
      "$HOME/.local/state/claude/locks",
      "$HOME/.cache/claude",
      "/tmp/claude-$UID"
    ],
    "read": [
      "$HOME/.local/bin",
      "$HOME/.local/share/claude"
    ],
    "allow_file": [
      "$HOME/.claude.json",
      "$HOME/.claude.json.lock",
      "$HOME/.claude.lock"
    ]
  },
  "network": {
    "block": false,
    "listen_port": [
      0
    ]
  },
  "credential_providers": {
    "claude_code": {
      "type": "oauth_capture",
      "token_endpoints": [
        {
          "host": "https://claude.ai",
          "path": "/oauth/token",
          "response_fields": [
            {
              "path": "access_token",
              "kind": "opaque"
            },
            {
              "path": "refresh_token",
              "kind": "opaque"
            }
          ],
          "request_body": "auto",
          "request_nonce_fields": [
            "refresh_token"
          ]
        },
        {
          "host": "https://claude.com",
          "path": "/oauth/token",
          "response_fields": [
            {
              "path": "access_token",
              "kind": "opaque"
            },
            {
              "path": "refresh_token",
              "kind": "opaque"
            }
          ],
          "request_body": "auto",
          "request_nonce_fields": [
            "refresh_token"
          ]
        },
        {
          "host": "https://platform.claude.com",
          "path": "/oauth/token",
          "response_fields": [
            {
              "path": "access_token",
              "kind": "opaque"
            },
            {
              "path": "refresh_token",
              "kind": "opaque"
            }
          ],
          "request_body": "auto",
          "request_nonce_fields": [
            "refresh_token"
          ]
        },
        {
          "host": "https://platform.claude.com",
          "path": "/v1/oauth/token",
          "response_fields": [
            {
              "path": "access_token",
              "kind": "opaque"
            },
            {
              "path": "refresh_token",
              "kind": "opaque"
            }
          ],
          "request_body": "auto",
          "request_nonce_fields": [
            "refresh_token"
          ]
        }
      ],
      "api_hosts": [
        "https://api.anthropic.com",
        "https://platform.claude.com"
      ],
      "credential_store": {
        "type": "keychain_json",
        "service": "Claude Code-credentials",
        "account_candidates": [
          "unknown",
          "$USER",
          "claude-code-user"
        ],
        "phantom_fields": [
          "claudeAiOauth.accessToken",
          "claudeAiOauth.refreshToken"
        ]
      },
      "helpers": {
        "status": [
          "claude",
          "auth",
          "status",
          "--json"
        ],
        "login": [
          "claude",
          "auth",
          "login"
        ],
        "logout": [
          "claude",
          "auth",
          "logout"
        ]
      }
    }
  },
  "credential_routes": [
    {
      "name": "claude_code_oauth",
      "provider": "claude_code"
    }
  ],
  "allow_parent_of_protected": true,
  "diagnostics": {
    "suppress_system_services": [
      "forbidden-exec-sugid"
    ]
  },
  "security": {
    "signal_mode": "isolated",
    "capability_elevation": false
  },
  "workdir": {
    "access": "readwrite"
  },
  "interactive": true,
  "open_urls": {
    "allow_origins": [
      "https://claude.ai",
      "https://claude.com",
      "https://platform.claude.com",
      "https://api.anthropic.com"
    ],
    "allow_localhost": true
  },
  "allow_launch_services": true
}