# Leaked Claude OAuth Token? Sign Out and Rotate > Claude OAuth access token exposed on GitHub? Sign out the tool that holds it, rotate the login and review your Claude account. Step-by-step guide. Source: https://leakwatch.net/secrets/claude-oauth-access-token --- [LeakWatch](/) [Product](/product)[Live feed](/leaks)[Guides](/secrets)[Blog](/blog)[Free scan](/) 1. [Home](/) 2. [Secrets](/secrets) 3. Claude OAuth Access Token AI · Secret guide # Leaked Claude OAuth Access Token: what to do in the first hour Critical severityChecked liveLast verified October 23, 2026 · 5 min read A Claude OAuth access token is not an API key. It is issued when someone signs a coding tool or other app into their Claude account, and it acts as that person. Whoever holds it can make requests as the signed-in user, which means the conversations, projects and settings tied to that login, plus any usage the account is allowed. Because the token identifies a person’s session rather than an API workspace, the damage is about identity as well as billing. Stop the session first, then rotate the login. [Check your GitHub account for leaked secrets — free](/) Provider Anthropic Severity Critical Impact Source code and build access Checked live by LeakWatch Yes ## What a Claude OAuth Access Token looks like Claude OAuth access tokens start with `sk-ant-oat`, then a version number, a dash, and a long body of letters, digits, hyphens and underscores: ```text sk-ant-oat01-…XXXX Claude OAuth access token (masked) ``` The format is case-sensitive, and the body is long, so a short string that merely starts with the same letters is not a token. Tools usually receive the value through an environment variable such as `CLAUDE_CODE_OAUTH_TOKEN`, which is why it often appears in shell profiles, `.env` files and CI settings. Two neighbouring values are easy to confuse with it. A refresh token uses the `sk-ant-ort` prefix and lets a tool obtain new access tokens, so it is at least as sensitive. An Anthropic API key starts with `sk-ant-api` and belongs to an API workspace, not to a person’s login. If the leaked file holds a refresh token as well, treat it as part of the same incident. For admin keys, see the [Anthropic Admin API key](/secrets/anthropic-admin-api-key) guide, and for ordinary API keys, see the [Anthropic API key](/secrets/anthropic-api-key) guide. ## How Claude OAuth Access Tokens get leaked - **Shell and environment configuration.** A `CLAUDE_CODE_OAUTH_TOKEN` export added to a dotfile, which then gets pushed to a public dotfiles repository. - **Scripts that set the variable inline.** A command written with the token as a literal argument or assignment, then committed to a shared script. - **CI and build logs.** A pipeline that prints its environment, or a debug step that echoes the variables passed to a container. - **Copied session files.** A tool’s configuration or credential file copied into a project folder for a teammate or a support request. - **Screenshots and chat threads.** A terminal capture or a pasted configuration block that still shows the value. ## What to do in the first hour 1. **Stop the session.** Sign out of the tool on every machine where the token may have been used. If the token lives in a CI system, remove it there and stop the jobs that use it. Do this before anything else, so that the exposure ends as soon as possible. 2. **Rotate the login.** Sign in again through the tool’s own flow, which issues a new token. Store the new value only in your secret store or in a local environment file that is ignored by Git. 3. **Review your Claude account.** In the account settings, look for connected apps, sessions and recent activity you do not recognize. Change the account password and turn on two-factor authentication if it is not already active. 4. **Check the usage views.** Look at the usage and cost pages for the period since the exposure. Look for spikes, models you never use and activity at unusual hours. 5. **Check for an API key in the same place.** If the file also held an Anthropic API key or an admin key, rotate it in the Console as well. Each credential has its own revocation path. 6. **Clean up the repository.** Remove the value from the current files and check the commit history for it. Old commits keep the value even after the file changes, so rotation remains the real fix. See [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github). 7. **Look for other secrets** next to the token, and search the wider history if the file was in an older branch. See [deep-scan your whole git history](/blog/deep-scan-your-whole-git-history). Not sure what else leaked? [Run a free scan](/). [Not sure what else leaked? Run a free scan.](/) ## Revoke it at Anthropic Claude OAuth access tokens are not listed in the Claude Console, so you cannot delete one there the way you delete an API key. Ending the session is the practical revocation: sign out of the tool that received the token, and sign in again on each device you trust so that a new token replaces it. If you are unsure whether the old value still works, check the sessions and connected apps described in the account settings page of Claude and look for entries that match the leak. Do not assume a sign-out has ended every session until the list confirms it. ## How LeakWatch detects it The rule is called “Claude OAuth Access Token”. It looks for the literal, case-sensitive prefix `sk-ant-oat`, then one or more digits, a dash, and then 80 to 150 characters made of letters, digits, hyphens and underscores, with word boundaries at both ends. Because the token is self-identifying, no nearby word is needed. The severity is **critical**, with the impact class for identity and code access. **This type is checked live**: LeakWatch can check whether a detected token is still active with a read-only request that lists the models available to it. It never sends a prompt and never reads your conversations. LeakWatch can check whether a detected key is still active with a read-only request to Anthropic. It never reads your data or spends your credits. ## FAQ Can someone read my Claude conversations with this token? A token that acts as your login can reach what the login can reach, so the conversations and projects in that account are exposed. Sign out of the sessions, rotate the login, and review what the account stores before you assume it is safe. The token was in a file for only a few minutes. Is that enough to ignore it? No. Automated scrapers read public repositories continuously, and a token that is still valid after a few minutes is already in someone else’s hands. Sign out and rotate first, then decide whether the exposure mattered. Why does signing out not always show up as a revocation? Tokens issued to a tool are tied to that tool’s session. Ending the session is what matters for the tool, but the account’s own list of sessions and connected apps is where you confirm it. If an entry you do not recognize is still listed, remove it and rotate the login. ## Related - [Anthropic (Claude) API Key](/secrets/anthropic-api-key) - [Anthropic Admin API Key](/secrets/anthropic-admin-api-key) - [OpenAI API key](/secrets/openai-api-key) - [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) - [Which vendors leak most this week](/leaks/trends) - [All secret guides](/secrets) [Get alerted next time a secret leaks — create a free account](/) LeakWatch is not affiliated with Anthropic. ![Gabriel Diyan, founder of LeakWatch](/brand/Photo-Gabriel-Diyan.webp) Gabriel Diyan (0xCr0c0) Cybersecurity student, founder of LeakWatch. I built and run the scanner described here — the detection patterns, the false-positive classifier and the provider validators are mine. [More about who I am](/about). [GitHub](https://github.com/Leakwatch-Scan) · [X](https://x.com/LeakwatchScan) · [LinkedIn](https://www.linkedin.com/in/gabriel-diyan-80a378375) · [GitHub (personal)](https://github.com/crocogab) LeakWatch Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about). Scan - [Product](/product) - [Live feed](/leaks) - [Trends](/leaks/trends) - [API docs](/docs) - [CI/CD](/docs?tab=ci) Read - [Blog](/blog) - [Secret guides](/secrets) - [Changelog](/changelog) - [About](/about) Verify - [Security](/security) - [Privacy](/privacy) - [Terms](/terms) - [Legal](/legal) - [Contact](/contact) - [Status](https://status.leakwatch.net) © 2026 LeakWatch [GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)