feat: Auto-Relogin for Anthropic OAuth via Persistent Browser Sessions

Problem

OAuth tokens expire after ~12 hours of inactivity, causing "Token refresh failed: 400" errors when users return to OpenCode. This is a widespread issue affecting many users:

Claude subscription token expires after a period of time #6559: "Usually it happens when I stopped using for a while, e.g. 12 hours"
Getting "Unauthorized: token expired" during conversation #4992: "Getting 'Unauthorized: token expired' during conversation"
The Claude Subscription Issue is back #8544: "The Claude Subscription Issue is back"

Current workaround: Users must manually re-login every morning, which disrupts workflow.

Root cause: Anthropic's OAuth refresh tokens become invalid after extended inactivity periods. This cannot be prevented by periodic token refresh or API pings - the session itself expires server-side.

Proposed Solution

Implement persistent headless browser sessions that can automatically refresh OAuth tokens when 400 errors occur.

How it works

One-time setup: User runs opencode auth browser setup, browser opens, user logs into claude.ai
Session persists: Browser profile saved to ~/.opencode/browsers/anthropic/<account-id>/
Auto-refresh: When a 400 error occurs:
- Headless browser launches with saved profile (already logged in)
- Navigates to OAuth authorize URL
- Automatically redirected to callback (no user interaction needed)
- New tokens extracted and saved
- Original request retried

Architecture

┌─────────────────┐     ┌──────────────┐     ┌─────────────────────┐
│ OpenCode        │────▶│ Auth Module  │────▶│ Headless Browser    │
│ (API Call)      │     │ (Error 400)  │     │ (Playwright)        │
└─────────────────┘     └──────────────┘     └─────────────────────┘
                               │                       │
                               ▼                       ▼
                        ┌──────────────┐     ┌─────────────────────┐
                        │ Retry with   │◀────│ New OAuth Token     │
                        │ new Token    │     │ (auto-extracted)    │
                        └──────────────┘     └─────────────────────┘

Features

Multi-Account Support

Each OAuth account gets its own browser profile, enabling auto-relogin for all accounts:

~/.opencode/browsers/anthropic/
  ├── <account-1-id>/    # Browser profile for Account 1
  ├── <account-2-id>/    # Browser profile for Account 2
  └── <account-n-id>/    # Browser profile for Account N

CLI Commands

# Setup browser session for an account
$ opencode auth browser setup
◆ Select account to configure:
│ ○ account-1@email.com
│ ● account-2@email.com
│
◐ Opening browser... Please log in to claude.ai
◐ Login detected. Saving session...
└ Browser session configured for account-2@email.com

# Check status of all browser sessions
$ opencode auth browser status
Account 1 (account-1@email.com): ● Active (last refresh: 2h ago)
Account 2 (account-2@email.com): ○ Not configured
Account 3 (account-3@email.com): ● Active (last refresh: 5min ago)

# Remove a browser session
$ opencode auth browser remove
◆ Select account to remove session:
│ ● account-1@email.com
│
└ Browser session removed

Desktop UI Integration

In Settings → Providers → Anthropic → [Account]:

┌─────────────────────────────────────────────────┐
│ Account: account@email.com                      │
├─────────────────────────────────────────────────┤
│ Usage: ████████░░ 80%                           │
│                                                 │
│ ─────────────────────────────────────────────── │
│                                                 │
│ 🔄 Auto-Relogin                                 │
│                                                 │
│ Status: ● Enabled                               │
│ Last Refresh: 2 hours ago                       │
│                                                 │
│ [Configure Session]  [Remove Session]           │
│                                                 │
├─────────────────────────────────────────────────┤
│ [Switch to this Account]  [Delete Account]      │
└─────────────────────────────────────────────────┘

Technical Implementation

New Files

File	Purpose
`packages/opencode/src/auth/browser.ts`	Headless browser session management
`packages/opencode/src/auth/auto-relogin.ts`	Error detection & auto-refresh logic

Modified Files

File	Changes
`packages/opencode/src/auth/index.ts`	Add `browserSession` field to OAuthRecord
`packages/opencode/src/cli/cmd/auth.ts`	Add `browser` subcommands
`packages/app/src/components/dialog-settings.tsx`	Add Auto-Relogin UI section
`packages/opencode/package.json`	Add Playwright dependency

Auth Store Schema Extension

const OAuthRecord = z.object({
  // ... existing fields ...
  browserSession: z.object({
    enabled: z.boolean(),
    profilePath: z.string(),
    lastRefresh: z.number().optional(),
    lastError: z.string().optional(),
  }).optional(),
})

API Endpoints

Endpoint	Purpose
`POST /auth/browser/setup`	Initiate browser session setup
`GET /auth/browser/status`	Get browser session status for all accounts
`DELETE /auth/browser/:recordId`	Remove browser session for account

Dependencies

Requires feat: Multi-Account OAuth Rotation with Settings UI #9068 (Multi-Account OAuth) for:
- Per-account OAuth record management
- Settings UI infrastructure
- Account selection in CLI

Security Considerations

Browser profiles stored locally in user's data directory
No credentials transmitted over network (browser handles auth natively)
Sessions can be removed at any time via CLI or UI
Headless browser runs only when needed (not persistent daemon)

Acceptance Criteria

opencode auth browser setup opens browser for login
Browser session persists after setup
400 errors trigger automatic token refresh
Multi-account: each account has separate session
CLI shows browser session status
Desktop UI shows status and config options
Sessions can be removed via CLI and UI
Works on macOS, Linux, Windows

Related Issues

Claude subscription token expires after a period of time #6559 - Claude subscription token expires after a period of time
Getting "Unauthorized: token expired" during conversation #4992 - Getting "Unauthorized: token expired" during conversation
The Claude Subscription Issue is back #8544 - The Claude Subscription Issue is back
OAuth token expires after inactivity causing 'Token refresh failed: 400' #9111 - OAuth token expires after inactivity (closed, solution didn't work)

Implementation Complete! 🎉

PR #9455 implements the auto-relogin feature as described in this issue.

How It Works

User's token expires overnight
         ↓
Plugin throws "Token refresh failed: 400"
         ↓
rotating-fetch.ts catches the error
         ↓
attemptBrowserRelogin() is called
         ↓
Headless Puppeteer + Stealth plugin launches
         ↓
Uses saved cookies from browser profile
         ↓
Navigates to claude.ai/oauth/authorize
         ↓
Auto-clicks "Authorize" button (user is still logged in via cookies)
         ↓
Extracts authorization code from callback URL
         ↓
Exchanges code for new access + refresh tokens
         ↓
Updates auth store with new tokens
         ↓
Retries the original failed request
         ↓
Success! ✅

Setup (One-Time)

```bash
opencode auth browser setup
```

This opens a browser window where you log in to claude.ai. The cookies are saved in an isolated browser profile at ~/.local/share/opencode/browsers/anthropic/<recordId>/.

Key Technical Decisions

Puppeteer over Playwright: Playwright was blocked by Cloudflare's bot detection. Puppeteer with puppeteer-extra-plugin-stealth successfully bypasses it.
Auto-install: Puppeteer and its dependencies are installed automatically on first use to keep the base package small.
Per-account profiles: Each OAuth account has its own isolated browser profile, so multiple accounts can have separate sessions.
Dual callback URLs: The implementation handles both console.anthropic.com/oauth/code/callback and platform.claude.com/oauth/code/callback since Anthropic uses both.
Profile locking: Prevents race conditions when multiple requests trigger auto-relogin simultaneously.

CLI Commands

Command	Description
`opencode auth browser setup`	Configure browser session (opens visible browser)
`opencode auth browser status`	Show all browser session statuses
`opencode auth browser remove`	Remove a browser session

Testing Results

✅ CLI: Auto-relogin works seamlessly
✅ Desktop: Auto-relogin works seamlessly
✅ Token invalidation test: Recovers automatically
✅ Multiple accounts: Each account can have its own browser session

Screenshots

(Will be added below)

Implementation Update

PR #9455 has been rebased onto latest dev (v1.1.30+) and is ready for review.

What's implemented:

✅ Persistent browser sessions via Puppeteer
✅ One-time setup: opencode auth browser setup
✅ Automatic re-authentication on 401 errors (headless)
✅ CLI: opencode auth browser [setup|status|refresh|remove]
✅ API: /provider/auth/browser/* endpoints
✅ Integration with rotating-fetch for seamless token refresh

How it solves the problem:

When OAuth tokens expire after ~12 hours of inactivity, the system:

Detects 401 error during API call
Launches headless browser with saved profile (already logged in)
Navigates to OAuth authorize URL → auto-redirects to callback
Extracts new tokens and retries the original request

No user interaction needed after initial setup!

Related PRs:

feat: Multi-Account OAuth Rotation with Settings UI and CLI Enhancements #9069 - Multi-Account OAuth (dependency)
feat: YOLO Mode - Skip All Permission Prompts (CLI + Desktop) #9073 - YOLO Mode (sibling, independent)
feat(auth): Auto-Relogin via Persistent Browser Sessions #9455 - This feature (Auto-Relogin) ← ready for review

Branch: feat/auto-relogin-browser-sessions-clean

Closing in favor of combined issue with all features

Navigation Menu

Repository navigation

feat: Auto-Relogin for Anthropic OAuth via Persistent Browser Sessions #9360

Problem

Proposed Solution

How it works

Architecture

Features

Multi-Account Support

CLI Commands

Desktop UI Integration

Technical Implementation

New Files

Modified Files

Auth Store Schema Extension

API Endpoints

Dependencies

Security Considerations

Acceptance Criteria

Related Issues

Implementation Complete! 🎉

How It Works

Setup (One-Time)

Key Technical Decisions

CLI Commands

Testing Results

Screenshots

Implementation Update

What's implemented:

How it solves the problem:

Related PRs:

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

feat: Auto-Relogin for Anthropic OAuth via Persistent Browser Sessions #9360

Description

Problem

Proposed Solution

How it works

Architecture

Features

Multi-Account Support

CLI Commands

Desktop UI Integration

Technical Implementation

New Files

Modified Files

Auth Store Schema Extension

API Endpoints

Dependencies

Security Considerations

Acceptance Criteria

Related Issues

Activity

mguttmann commented on Jan 19, 2026

Implementation Complete! 🎉

How It Works

Setup (One-Time)

Key Technical Decisions

CLI Commands

Testing Results

Screenshots

mguttmann commented on Jan 19, 2026

mguttmann commented on Jan 21, 2026

Implementation Update

What's implemented:

How it solves the problem:

Related PRs:

mguttmann commented on Jan 22, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions