{"id":2976,"date":"2026-11-09T10:44:35","date_gmt":"2026-11-09T10:44:35","guid":{"rendered":"https:\/\/hostry.com\/blog\/?p=2976"},"modified":"2026-11-09T11:51:30","modified_gmt":"2026-11-09T11:51:30","slug":"claude-code-codex-login-headless-vps","status":"publish","type":"post","link":"https:\/\/hostry.com\/blog\/claude-code-codex-login-headless-vps\/","title":{"rendered":"Claude Code Login on a Headless VPS: Fix Redirect URI and OAuth Errors"},"content":{"rendered":"\n
\"Claude<\/figure>\n\n\n\n
Running claude over SSH and waiting for the laptop's browser to hand the login back is the usual first attempt, but the callback listens on the VPS, so paste the code instead. If the sign-in page rejects the request (\"Redirect URI \u2026 is not supported by client\"), make a setup-token on a laptop, then try an API key; \"Invalid OAuth Request\" usually means the URL was cut, so copy it with c.<\/strong><\/em><\/pre>\n\n\n\n
A Claude Code login<\/strong> on a server without a browser has three supported routes, numbered below: a pasted sign-in code, a one-year token from claude setup-token<\/span>, and a Console API key. A rejected redirect happens before you ever see a code, which is why it skips Route 1.<\/p>\n\n\n\n
The flags and prompts quoted below were observed by installing Claude Code 2.1.319 and Codex CLI 0.167.0, the current npm releases, in a clean test environment on November 9, 2026. Error messages from GitHub reports are credited to their issues. The steps fit any Linux box you reach over SSH, such as a KVM VPS kept on as a remote dev box<\/a><\/strong>. Examples use the user dev<\/span> and the host vps.example.com (203.0.113.10); put your own names in their place.<\/p>\n\n\n\n
Claude Code login errors over SSH and what causes each one<\/h2>\n\n\n\n
Match your message to a row; the Where column says whether it came from the browser or the VPS terminal.<\/p>\n\n\n\n
What you see<\/th>Where<\/th>Likely cause<\/th>What to do<\/th><\/tr><\/thead>
Login page loads, then nothing returns to the terminal<\/td>Browser<\/td>Expected over SSH: the redirect cannot reach the VPS<\/td>Paste the code (Route 1)<\/td><\/tr>
Redirect URI https:\/\/platform.claude.com\/oauth\/code\/callback is not supported by client.<\/code><\/td>Browser, after “Authorization failed”<\/td>The authorization server rejects the code-paste redirect<\/td>Token from your laptop (Route 2) or API key (Route 3)<\/td><\/tr>
Invalid OAuth Request<\/code> with Invalid response_type: missing. Expected: 'code'<\/code> or Missing scope parameter<\/code><\/td>Browser<\/td>The URL reached the browser incomplete<\/td>Copy it with c<\/code> or from claude auth login<\/code><\/td><\/tr>
OAuth error: Invalid code. Please make sure the full code was copied<\/code><\/td>Terminal<\/td>Code expired or was cut while pasting<\/td>Start again and paste promptly<\/td><\/tr>
OAuth authentication is currently not supported.<\/code> (API Error 401)<\/td>Terminal<\/td>An OAuth token placed in ANTHROPIC_AUTH_TOKEN<\/code><\/td>Use CLAUDE_CODE_OAUTH_TOKEN<\/code><\/td><\/tr>
This organization has been disabled<\/code> (API Error 400) with an active plan<\/td>Terminal<\/td>An old ANTHROPIC_API_KEY<\/code> overrides your subscription<\/td>Unset the key<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Row one is the ordinary SSH case. On the VPS, Claude Code opens its OAuth callback listener on 127.0.0.1 with a port the system assigns for each attempt, and that address exists only inside the server. To see it, run ss -ltnp | grep claude<\/span> in a second SSH session while the login waits; the port changes from one attempt to the next.<\/p>\n\n\n\n
For that reason, the URL Claude Code gives you to copy uses a different redirect, to platform.claude.com, which shows a code in the browser for you to paste back. Anthropic’s install and login troubleshooting page<\/a><\/strong> describes exactly this for WSL2, SSH sessions and containers.<\/p>\n\n\n\n
“Redirect URI is not supported by client”<\/h3>\n\n\n\n
Switch routes rather than retrying the same URL<\/strong>, because nothing on the VPS fixes a rejected redirect. Run claude setup-token<\/span> on a laptop that has a browser (Route 2). There the browser returns to Claude Code through its local listener, and the code-paste redirect is not part of the flow. If the laptop gets the same rejection, use an API key (Route 3).<\/p>\n\n\n\n
GitHub reports of this message cover Claude Code 2.1.79 through 2.1.267, from desktops as well as from an Ubuntu VPS and an HPC cluster reached over SSH. In issue #93216<\/a><\/strong> one reporter’s 2.1.251 signed in on September 9, 2026 and failed the next day with no local change, and according to the thread, downgrading did not help. Reporters read it as a server-side rejection, and the docs we checked on November 9 do not list it. The laptop route is not a guaranteed way out either: one commenter on issue #36215<\/a><\/strong> saw the localhost redirect rejected the same way.<\/p>\n\n\n\n