Anthropic OAuth token endpoint URL migration issues

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

• #51723 fix(anthropic): use platform.claude.com for OAuth login token exchange

  merged to main

  files: agent/anthropic_adapter.py, hermes_cli/web_server.py, scripts/release.py, tests/agent/test_anthropic_oauth_pkce.py

  Show the diff

  • agent/anthropic_adapter.py

    @@ -1297,7 +1297,15 @@ def run_oauth_setup_token() -> Optional[str]:
     # Stores credentials in ~/.hermes/.anthropic_oauth.json (our own file).
     
     _OAUTH_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e"
    -_OAUTH_TOKEN_URL = "[redacted:secret-assignment]"
    +# Anthropic migrated the OAuth token endpoint to platform.claude.com;
    +# console.anthropic.com now 404s. Callers should iterate _OAUTH_TOKEN_URLS
    +# (new host first, console fallback). _OAUTH_TOKEN_URL is kept as the primary
    +# for backward compatibility with existing imports and now points at the live host.
    +_OAUTH_TOKEN_URLS = [
    +    "https://platform.claude.com/v1/oauth/token",
    +    "https://console.anthropic.com/v1/oauth/token",
    +]
    +_OAUTH_TOKEN_URL = [redacted:secret-assignment]
     _OAUTH_REDIRECT_URI = "https://console.anthropic.com/oauth/code/callback"
     _OAUTH_SCOPES = "org:create_api_key user:profile user:inference"
     _HERMES_OAUTH_FILE = get_hermes_home() / ".anthropic_oauth.json"
    @@ -1395,18 +1403,34 @@ def run_hermes_oauth_login_pure() -> Optional[Dict[str, Any]]:
                 "code_verifier": verifier,
             }).encode()
     
    -        req = urllib.request.Request(
    -            _OAUTH_TOKEN_URL,
    -            data=exchange_data,
    -            headers={
    -                "Content-Type": "application/json",
    -                "User-Agent": f"claude-cli/{_get_claude_code_version()} (external, cli)",
    -            },
    -            method="POST",
    -        )
    +        # Anthropic migrated the OAuth token endpoint to platform.claude.com;
    +        # console.anthropic.com now 404s. Try the new host first, then fall
    +        # back to console for older deployments (mirrors the refresh path).
    +        result = None
    +        last_error = None
    +        for endpoint in _OAUTH_TOKEN_URLS:
    +            req = urllib.request.Request(
    +                endpoint,
    +                data=exchange_data,
    +                headers={
    +                    "Content-Type": "application/json",
    +                    "User-Agent": f"claude-cli/{_get_claude_code_version()} (external, cli)",
    +                },
    +                method="POST",
    +            )
    +            try:
    +                with urllib.request.urlopen(req, timeout=15) as resp:
    +                    result = json.loads(resp.read().decode())
    +                break
    +            except Exception as exc:
    +                last_error = exc
    +                logger.debug("Anthropic token exchange failed at %s: %s", endpoint, exc)
    +                continue
     
    -        with urllib.request.urlopen(req, timeout=15) as resp:
    -            result = json.loads(resp.read().decode())
    +        if result is None:
    +            raise last_error if last_error is not None else ValueError(
    +                "Anthropic token exchange failed"
    +            )
         except Exception as e:
             print(f"Token exchange failed: {e}")
             return None

  • hermes_cli/web_server.py

    @@ -6123,6 +6123,7 @@ async def disconnect_oauth_provider(
         from agent.anthropic_adapter import (
             _OAUTH_CLIENT_ID as _ANTHROPIC_OAUTH_CLIENT_ID,
             _OAUTH_TOKEN_URL as _ANTHROPIC_OAUTH_TOKEN_URL,
    +        _OAUTH_TOKEN_URLS as _ANTHROPIC_OAUTH_TOKEN_URLS,
             _OAUTH_REDIRECT_URI as _ANTHROPIC_OAUTH_REDIRECT_URI,
             _OAUTH_SCOPES as _ANTHROPIC_OAUTH_SCOPES,
             _generate_pkce as _generate_pkce_pair,
    @@ -6311,22 +6312,31 @@ def _submit_anthropic_pkce(
             "redirect_uri": _ANTHROPIC_OAUTH_REDIRECT_URI,
             "code_verifier": sess["verifier"],
         }).encode()
    -    req = urllib.request.Request(
    -        _ANTHROPIC_OAUTH_TOKEN_URL,
    -        data=exchange_data,
    -        headers={
    -            "Content-Type": "application/json",
    -            "User-Agent": "hermes-dashboard/1.0",
    -        },
    -        method="POST",
    -    )
    -    try:
    -        with urllib.request.urlopen(req, timeout=20) as resp:
    -            result = json.loads(resp.read().decode())
    -    except Exception as e:
    +    # Anthropic migrated the OAuth token endpoint to platform.claude.com;
    +    # console.anthropic.com now 404s. Try the new host first, then fall back.
    +    result = None
    +    last_exc = None
    +    for _endpoint in _ANTHROPIC_OAUTH_TOKEN_URLS:
    +        req = urllib.request.Request(
    +            _endpoint,
    +            data=exchange_data,
    +            headers={
    +                "Content-Type": "application/json",
    +                "User-Agent": "hermes-dashboard/1.0",
    +            },
    +            method="POST",
    +        )
    +        try:
    +            with urllib.request.urlopen(req, timeout=20) as resp:
    +                result = json.loads(resp.read().decode())
    +            break
    +        except Exception as e:
    +            last_exc = e
    +            continue
    +    if result is None:
             with _oauth_sessions_lock:
                 sess["status"] = "error"
    -            sess["error_message"] = f"Token exchange failed: {e}"
    +            sess["error_message"] = f"Token exchange failed: {last_exc}"
             return {"ok": False, "status": "error", "message": sess["error_message"]}
     
         access_token = [redacted:secret-assignment]"access_token", "")

  • scripts/release.py

    @@ -47,6 +47,7 @@
     AUTHOR_MAP = {
         "[redacted:email]": "wgu9",  # PR #51468 salvage (WSL/no-systemd orphan gateway tracking, #51325)
         "[redacted:email]": "uperLu",  # PR #50958 salvage (rename plugins/cron → plugins/cron_providers; #50872)
    +    "[redacted:email]": "yusekiotacode",  # PR #48706 salvage (anthropic OAuth login token endpoint → platform.claude.com; #45250/#49821)
         "[redacted:email]": "s010mn",  # PR #29221 salvage (ollama-cloud reasoning_effort xhigh→max)
         "[redacted:email]": "jeeves-assistant",  # PR #50771 (computer-use CuaDriver vision capture routing)
         "[redacted:email]": "ScotterMonk",  # PR #50145 salvage (cron output truncation: adapter-aware chunking, #50126)

  • tests/agent/test_anthropic_oauth_pkce.py

    @@ -148,6 +148,111 @@ def fake_input(*_a, **_kw):
         )
     
     
    +def test_login_token_exchange_uses_platform_claude_host(monkeypatch, tmp_path):
    +    """The login token exchange must hit ``platform.claude.com`` first.
    +
    +    Anthropic migrated the OAuth token endpoint to ``platform.claude.com``;
    +    ``console.anthropic.com`` now 404s, so a hardcoded console host makes a
    +    fresh login impossible (issue #45250 / #49821). The refresh path already
    +    iterates the new host first — the login path must do the same.
    +    """
    +    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
    +
    +    captured_token: [redacted:secret-assignment] Any] = {}
    +    captured_url: Dict[str, str] = {}
    +    _patch_oauth_flow(
    +        monkeypatch,
    +        callback_code="placeholder",
    +        capture_token_request=[redacted:secret-assignment]
    +        capture_auth_url=captured_url,
    +    )
    +
    +    import builtins
    +
    +    def fake_input(*_a, **_kw):
    +        qs = parse_qs(urlparse(captured_url.get("url", "")).query)
    +        state = qs.get("state", [""])[0]
    +        return f"auth-code#{state}"
    +
    +    monkeypatch.setattr(builtins, "input", fake_input)
    +
    +    from agent.anthropic_adapter import run_hermes_oauth_login_pure
    +
    +    result = run_hermes_oauth_login_pure()
    +
    +    assert result is not None, "login should succeed against the live host"
    +    assert captured_token["url"] == "https://platform.claude.com/v1/oauth/token", (
    +        "login token exchange must target platform.claude.com first, not the "
    +        "dead console.anthropic.com host (regression of #45250 / #49821)"
    +    )
    +
    +
    +def test_login_token_exchange_falls_back_to_console_host(monkeypatch, tmp_path):
    +    """If ``platform.claude.com`` is unreachable, the login path must fall back
    +    to the legacy ``console.anthropic.com`` host — mirroring the refresh path's
    +    fallback list — rather than failing outright.
    +    """
    +    import urllib.request
    +
    +    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
    +
    +    captured_url: Dict[str, str] = {}
    +    _patch_oauth_flow(
    +        monkeypatch,
    +        callback_code="placeholder",
    +        capture_auth_url=captured_url,
    +    )
    +
    +    attempts: list[str] = []
    +
    +    class _FakeResponse:
    +        def __init__(self, body: bytes) -> None:
    +            self._body = body
    +
    +        def __enter__(self):
    +            return self
    +
    +        def __exit__(self, *_exc):
    +            return False
    +
    +        def read(self):
    +            return self._body
    +
    +    def fake_urlopen(req, *_a, **_kw):
    +        attempts.append(req.full_url)
    +        if req.full_url.startswith("https://platform.claude.com"):
    +            raise RuntimeError("HTTP Error 404: Not Found")
    +        body = json.dumps(
    +            {
    +                "access_token": "sk-ant-test-access",
    +                "refresh_token": "sk-ant-test-refresh",
    +                "expires_in": 3600,
    +            }
    +        ).encode()
    +        return _FakeResponse(body)
    +
    +    monkeypatch.setattr(urllib.request, "urlopen", fake_urlopen)
    +
    +    import builtins
    +
    +    def fake_input(*_a, **_kw):
    +        qs = parse_qs(urlparse(captured_url.get("url", "")).query)
    +        state = qs.get("state", [""])[0]
    +        return f"auth-code#{state}"
    +
    +    monkeypatch.setattr(builtins, "input", fake_input)
    +
    +    from agent.anthropic_adapter import run_hermes_oauth_login_pure
    +
    +    result = run_hermes_oauth_login_pure()
    +
    +    assert result is not None, "login should succeed via the console fallback"
    +    assert attempts == [
    +        "https://platform.claude.com/v1/oauth/token",
    +        "https://console.anthropic.com/v1/oauth/token",
    +    ], "login must try platform.claude.com first, then fall back to console"
    +
    +
     def test_callback_state_mismatch_aborts(monkeypatch, tmp_path, caplog):
         """If the state returned in the callback does not match the one we sent
         in the authorization URL, the flow must abort before exchanging the code.