Skip to content

fix(oauth): plain HTTP token exchange to avoid 429#51

Closed
soxfmr wants to merge 1 commit intomirrorange:mainfrom
soxfmr:fix/oauth-cookie-token-refresh
Closed

fix(oauth): plain HTTP token exchange to avoid 429#51
soxfmr wants to merge 1 commit intomirrorange:mainfrom
soxfmr:fix/oauth-cookie-token-refresh

Conversation

@soxfmr
Copy link
Copy Markdown
Contributor

@soxfmr soxfmr commented Mar 20, 2026

Problem

The client reported 429 from the the OAuth API:

clove  | 2026-03-20 11:26:54.459 | ERROR    | app.services.oauth:authenticate_account:326 - OAuth authentication failed: ClaudeHttpError(error_code=50
3130, message_key='claudeClient.httpError', status_code=429, context={'url': 'https://console.anthropic.com/v1/oauth/token', 'status_code': 429, 'erro
r_type': 'Unknown', 'error_message': 'Error occurred during request to Claude.ai'})

It seems this is related to the rate limit problem, but it is not. Anthropic has enforced a new policy for the requests rejecting some client fingerprinting headers (User-Agent, Origin, TLS JA3 etc.). You could check the reference URLs for more details.

Changes

We have taken the same approach of shahidshabbir-se/opencode-anthropic-oauth by creating a plain http session with the favored headers for the OAuth API.

  • Add create_plain_session() preferring httpx (no browser fingerprinting)
  • Add _token_request() using plain session with only Content-Type header to avoid 429 on console.anthropic.com/v1/oauth/token

References

- Add create_plain_session() preferring httpx (no browser fingerprinting)
- Add _token_request() using plain session with only Content-Type header
  to avoid 429 on console.anthropic.com/v1/oauth/token

Co-Authored-By: Claude Opus 4.6 <[email protected]>
@soxfmr soxfmr closed this Mar 21, 2026
Rivenlalala pushed a commit to Rivenlalala/clove that referenced this pull request Mar 25, 2026
Anthropic now rejects requests to console.anthropic.com/v1/oauth/token
that carry browser fingerprinting headers (User-Agent, Origin, TLS JA3).
Switch token exchange and refresh to use a plain httpx session instead
of the chrome-impersonating client.

Ref: mirrorange#51

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant