anthropics / anthropics/claude-code

[FEATURE] `claude auth login --email` should force the OAuth account chooser (prompt=select_account) instead of reusing the browser's claude.ai session

オープン
#87,922 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る
area:auth area:cli enhancement
主要言語
Python
スター
145k
フォーク
23.1k
PR マージ指標
PR 指標を取得中

説明

### Preflight Checklist

- [x] I have searched [existing requests](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20label%3Aenhancement) and this feature hasn't been requested yet
- [x] This is a single feature request (not multiple features)

> **Relationship to #30031:** #30031 asks for *storing and switching between multiple credentials* (`claude auth switch`). This issue is about a different, smaller gap in the **login flow itself**: today there is no way to reach a specific account through OAuth without first logging out of claude.ai in the browser. I searched #30031's full thread (body + 11 comments) — `select_account`, "account chooser", "consent screen" and "browser session" do not appear anywhere in it. The two are complementary: this one is worth fixing even if #30031 is never built.

### Problem Statement

`claude auth login` always completes against whatever claude.ai session my browser already holds. There is no way to tell it *which* account I want.

`claude auth login --email ` looks like it should solve this, but it only **pre-populates** the email field on the login page. If a claude.ai session already exists in the browser, the flow completes against that session and the `--email` value has no effect on which account I end up as.

The practical consequence is that reaching my second account requires leaving the terminal and destroying an unrelated browser session:

1. `claude auth login --email ` in the terminal.
2. Browser opens — and signs me straight back in as **account A**.
3. Go to claude.ai and **log out of account A**. *(This is the step that hurts: it's unrelated to the CLI, and it kills a web session I was actively using.)*
4. Log in as account B, complete 2FA.
5. Return to the terminal and re-run the login.

Steps 2–4 exist purely because the CLI cannot express "authenticate as this account."

### Proposed Solution

When `--email` is supplied (or via an explicit `--select-account` flag), add `prompt=select_account` to the OAuth authorization URL so the consent page presents the account chooser instead of silently reusing the current session.

This is standard OAuth behaviour and is what Google, GitHub, Slack and Microsoft all do — `prompt=select_account` exists in the OIDC spec for exactly this case.

Expected result:

```console
$ claude auth login --email me@example.com
# browser opens on the account chooser, already filtered to me@example.com
# → signs in as me@example.com regardless of which account the browser session holds
# → no claude.ai logout required
```

Ideally `--email` would also **verify** the result: if the flow completes as a different account than the one requested, fail loudly rather than silently authenticating the wrong identity. Silently ending up on the wrong account is its own hazard when one is a work account and the other is personal.

### Alternative Solutions

Things I tried before filing:

| Alternative | Outcome |
|---|---|
| `CLAUDE_CONFIG_DIR=~/.claude-b` | Does isolate auth (a fresh config dir reports `loggedIn: false`, and per [@Samic333's measurement](https://github.com/anthropics/claude-code/issues/30031#issuecomment-5227127606) credentials are keyed per config dir). But it forks *everything else*: my `~/.claude` holds 2.8 GB of project transcripts, 287 auto-memory files, installed plugins, settings and 4.4 MB of history. The second account starts with no memory, no history and no plugins. It also doesn't remove the browser logout — the **first** login into that profile hits the same wall. |
| `claude auth logout && claude auth login --email ` | The workaround in #30031. Still lands on the browser's existing session, so the manual claude.ai logout is still required. |
| `claude setup-token` / `ANTHROPIC_API_KEY` | Switches me to usage-based Console billing. I already pay for two subscriptions and shouldn't need a third billing path to use them. |
| Separate browser profile / private window | Works, but means keeping a dedicated browser profile per account purely to defeat session stickiness, and re-doing 2FA on every private window. |

### Priority

High - Significant impact on productivity

### Feature Category

CLI commands and flags

### Use Case Example

I hold two paid Claude accounts and use Claude Code as my primary development environment (1,908 CLI startups on this machine). When one account reaches its usage limit mid-task, I move to the other:

1. Account A hits its limit partway through a task.
2. I want to continue as account B.
3. Today: browser → log out of A → log in as B → 2FA → back to terminal → `/login` → browser round-trip again.
4. With `prompt=select_account`: `claude auth login --email ` → pick B in the chooser → done, without touching my web session.

The same friction applies to the far more common personal/work split — anyone who is signed into claude.ai as their work account and wants Claude Code on their personal account (or vice versa) hits this identical wall, with the added risk of silently authenticating as the wrong one.

### Additional Context

- **Environment:** Claude Code 2.1.234, macOS 27.0 (Darwin), arm64, Max 20x subscription.
- `claude auth status` already emits machine-readable JSON including `email` — so the CLI has everything it needs to detect and report an account mismatch after login.
- This is a small change (one query parameter on the authorization URL, plus an optional post-login identity assertion) with a disproportionate UX payoff: it removes the browser logout entirely, which is the single most painful step in every multi-account workflow described in #30031.
- Happy to test a build on macOS or Linux and report back.

コントリビューションガイド

このリポジトリのコントリビューションガイドは索引されていません

調査の方向性

Start with the implementation behind `claude auth login --email`, tracing where its OAuth authorization URL is built; use `claude auth status` to inspect the resulting identity. Done means the requested account can be selected without logging out of claude.ai, with a mismatch reported if login completes as a different account.

索引モデルが issue の本文から書いたものです。

評価

領域
authentication, cli
issue の種類
機能追加
難易度
3/5
見積もり時間
1〜2日
活発さ
活発
明瞭さ
おおむね明確
初心者へのやさしさ
55/100

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。