stablyai/orca · error · Error

Claude login completed, but no OAuth credentials were captur

Error message

Claude login completed, but no OAuth credentials were captured.

What it means

Thrown by captureAuthFromConfigDir() when readCapturedCredentials() returns null/empty after a login. On macOS this means neither the scoped nor the legacy Keychain item yielded credentials (and the legacy value did not change from baseline). On Linux/Windows the .credentials.json was absent or empty. The login reportedly completed but no OAuth credential material was found to persist.

Source

Thrown at src/main/claude-accounts/service.ts:724

      }
      return
    }
    rmSync(tempConfig.windowsPath, { recursive: true, force: true })
  }

  private async captureAuthFromConfigDir(
    configDir: string,
    statusOutput: string,
    previousLegacyKeychain: string | null,
    previousLegacyCredentialsSha256?: string | null
  ): Promise<CapturedClaudeAuth> {
    const credentialsJson = await this.readCapturedCredentials(
      configDir,
      previousLegacyKeychain,
      previousLegacyCredentialsSha256
    )
    if (!credentialsJson) {
      throw new Error('Claude login completed, but no OAuth credentials were captured.')
    }
    const oauthAccount = this.readOauthAccountFromConfigDir(configDir)
    const identity = this.resolveIdentity(statusOutput, oauthAccount, credentialsJson)
    return { credentialsJson, oauthAccount, identity }
  }

  private async readCapturedCredentials(
    configDir: string,
    previousLegacyKeychain: string | null,
    previousLegacyCredentialsSha256?: string | null
  ): Promise<string | null> {
    if (process.platform === 'darwin') {
      const scopedCredentialsJson = await readActiveClaudeKeychainCredentialsStrict(configDir)
      if (scopedCredentialsJson) {
        return scopedCredentialsJson
      }
      const legacyCredentialsJson = await readActiveClaudeKeychainCredentialsStrict()
      const legacyChanged =

View on GitHub (pinned to 1136503c6a)

Solutions

Ensure CLAUDE_CONFIG_DIR passed to `claude auth login` matches the dir read by readCapturedCredentials.
On macOS, grant Keychain access to the CLI/Orca and confirm the login Keychain is unlocked.
Update the Claude CLI so it honors CLAUDE_CONFIG_DIR for Keychain scoping.
Retry the login; if persistent, inspect where the CLI actually wrote credentials.

Defensive patterns

Strategy: try-catch

Try / catch

try {
  return await captureAuthFromConfigDir(...)
} catch (error) {
  if (error instanceof Error && /no OAuth credentials were captured/.test(error.message)) {
    // verify CLAUDE_CONFIG_DIR alignment and Keychain access, then retry
  }
  throw error
}

Prevention

Keep CLAUDE_CONFIG_DIR identical between login spawn and credential read.
On macOS, unlock the Keychain and grant CLI access before login.
Update the Claude CLI to honor CLAUDE_CONFIG_DIR for Keychain scoping.
Confirm the login fully completed (browser step + credential write) before capture.

When it happens

Trigger: On macOS: the Claude CLI did not write to the scoped or legacy Keychain item, or wrote an identical value. On Linux/Windows: .credentials.json is missing or empty after login. The CLI wrote credentials elsewhere (wrong CLAUDE_CONFIG_DIR). A login that exited 0 but never authenticated (e.g. user closed the browser).

Common situations: CLAUDE_CONFIG_DIR mismatch between spawn and read. Keychain access denied on macOS so the CLI silently failed to store. Older CLI version ignoring CLAUDE_CONFIG_DIR and writing to the default location. The login was interrupted after the browser step but before credential persistence.

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/3cf70b356bfa91a1. Report an issue: GitHub.