Name unsupported Claude OAuth token in CLI secret setup by Copilot · Pull Request #66669 · github/gh-aw

Copilot · 2026-10-07T19:40:28Z

Claude Code users with only CLAUDE_CODE_OAUTH_TOKEN receive an unclear authentication failure because gh-aw does not support that credential.

Credential diagnosis: When Claude secret setup finds only that token, report it as unsupported and point to ANTHROPIC_API_KEY or Anthropic Workload Identity Federation. Never include the token value in the error.
Credential precedence: Continue accepting a supported API key from the environment or an existing repository secret.
Coverage: Add focused tests for interactive and trial-run secret setup.

Fixes [deep-report] Name the unsupported CLAUDE_CODE_OAUTH_TOKEN instead of silently failing auth #66656

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

🟡 Changes recommended

An existing credential-resolution test becomes dependent on the developer’s ambient Claude OAuth environment.

1 open finding

Clear CLAUDE_CODE_OAUTH_TOKEN to keep credential tests deterministic · New

What changed in this PR

Adds explicit diagnostics when Claude secret setup encounters only the unsupported OAuth token.

Changes:

Detects CLAUDE_CODE_OAUTH_TOKEN without exposing its value.
Preserves supported API-key and repository-secret precedence.
Adds interactive and secret-resolution tests.

File	Description
`pkg/cli/engine_secrets.go`	Adds unsupported-token detection and guidance.
`pkg/cli/engine_secrets_test.go`	Tests detection and credential precedence.
`pkg/cli/add_interactive_secrets_test.go`	Tests interactive setup diagnostics.

🧠 Review effort: Balanced

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Copilot · 2026-10-07T20:57:58Z

+	if engine == string(constants.ClaudeEngine) && value == "" && os.Getenv("CLAUDE_CODE_OAUTH_TOKEN") != "" { //nolint:osgetenvlibrary
+		return "", "", false, errUnsupportedClaudeOAuthToken


Fixed in 324e108: TestGetEngineSecretNameAndValue now clears CLAUDE_CODE_OAUTH_TOKEN at setup; the focused OAuth test still sets it explicitly.

gh-aw-bot · 2026-10-07T20:45:58Z

@copilot address the following outstanding work in one pass:

Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.
Review (pkg/cli/engine_secrets.go:715): This new ambient-environment branch makes the pre-existing TestGetEngineSecretNameAndValue/no alternative secret in repo host-dependent: that subtest clears ANTHROPIC_API_KEY but not CLAUDE_CODE_OAUTH_TOKEN, so developers with a normal Claude login will now get this error instead of the asserted empty credential. Please clear CLAUDE_CODE_OAUTH_TOKEN at the start of TestGetEngineSecretNameAndValue (and let the focused test set it explicitly) so the package tests remain deterministic. - Name unsupported Claude OAuth token in CLI secret setup #66669 (comment)

Push the necessary fixes, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved. Use the pr-finisher skill and stop when only human review or CI remains; do not trigger CI.

Sous-chef head: 9bd7c88
Sous-chef work: 47a4325d485558d69d0d8870d32a35c91ddc0d6a86f89863d68ede3cabfd7898
Sous-chef state: 84d7b7b6d50b72f8a01603f88ca8236a5556d44e2959867ddcb887a9080df016

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · 5.6 AIC · ⌖ 10.7 AIC · ⊞ 1K · ◷
_{Comment /souschef to run again}

…ame-unsupported-clause-code-oauth-tok Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-10-07T20:57:57Z

@copilot address the following outstanding work in one pass:

Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes....

Merged the latest main and committed the deterministic test setup fix in 324e108. The focused test and impacted tests passed; make agent-report-progress also reported five pre-existing custom-linter findings in unchanged sections of pkg/cli/engine_secrets.go. No CI was triggered.

github-actions · 2026-10-08T19:07:49Z

🎉 This pull request is included in a new release.

Release: v0.91.6

PR #66669 changed the gh aw CLI secret setup path to detect CLAUDE_CODE_OAUTH_TOKEN and fail with an explicit error naming the token and the supported alternatives, instead of silently ignoring it. Update the two docs call out sites that still described the old silent-ignore / unnamed-error behavior. Closes #66656

Initial plan

ee2300d

Copilot AI assigned Copilot and pelikhan Oct 7, 2026

Copilot started work on behalf of pelikhan October 7, 2026 19:41 View session

Copilot AI linked an issue Oct 7, 2026 that may be closed by this pull request

[deep-report] Name the unsupported CLAUDE_CODE_OAUTH_TOKEN instead of silently failing auth #66656

Closed

Explain unsupported Claude OAuth token during CLI secret setup

9bd7c88

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add support for CLAUDE_CODE_OAUTH_TOKEN authentication~~ Name unsupported Claude OAuth token in CLI secret setup Oct 7, 2026

Copilot AI requested a review from pelikhan October 7, 2026 19:53

Copilot finished work on behalf of pelikhan October 7, 2026 19:53

pelikhan marked this pull request as ready for review October 7, 2026 20:09

Copilot AI balanced review requested due to automatic review settings October 7, 2026 20:09

Copilot started reviewing on behalf of pelikhan October 7, 2026 20:09 View session

Copilot AI reviewed Oct 7, 2026

View reviewed changes

github-actions Bot mentioned this pull request Oct 7, 2026

[pr-sous-chef] 🍳 PR Sous Chef Summary: 4 PRs nudged toward completion #66387

Closed

Copilot started work on behalf of gh-aw-bot October 7, 2026 20:46 View session

Copilot AI and others added 2 commits October 7, 2026 20:51

Merge remote-tracking branch 'origin/main' into copilot/deep-report-n…

30a5af0

…ame-unsupported-clause-code-oauth-tok Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Isolate Claude OAuth env in secret test

324e108

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot AI requested a review from gh-aw-bot October 7, 2026 20:59

Copilot finished work on behalf of gh-aw-bot October 7, 2026 20:59

pelikhan merged commit 3bafb7d into main Oct 7, 2026
4 checks passed

pelikhan deleted the copilot/deep-report-name-unsupported-clause-code-oauth-tok branch October 7, 2026 22:11

github-actions Bot mentioned this pull request Oct 8, 2026

[docs] Self-healing documentation fixes from issue analysis - 2026-10-08 #67028

Merged

Navigation Menu

Repository navigation

Name unsupported Claude OAuth token in CLI secret setup - #66669

Name unsupported Claude OAuth token in CLI secret setup#66669
pelikhan merged 4 commits into
mainfrom
copilot/deep-report-name-unsupported-clause-code-oauth-tok

Copilot AI commented Oct 7, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Oct 7, 2026

Uh oh!

gh-aw-bot commented Oct 7, 2026

Uh oh!

Copilot AI commented Oct 7, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		if engine == string(constants.ClaudeEngine) && value == "" && os.Getenv("CLAUDE_CODE_OAUTH_TOKEN") != "" { //nolint:osgetenvlibrary
		return "", "", false, errUnsupportedClaudeOAuthToken

Conversation

Copilot AI commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Copilot AI Oct 7, 2026

Choose a reason for hiding this comment

Uh oh!

gh-aw-bot commented Oct 7, 2026

Uh oh!

Copilot AI commented Oct 7, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Oct 7, 2026 •

edited

Loading