Error messages

Your account does not have access to Claude. Please login again or contact your administrator.

Your account does not have access to Claude. Please login again or contact your administrator.

A 403 is the HTTP code for "I know who you are and the answer is still no". Claude Code turns the ones it recognizes into specific sentences and passes the rest through with the server's own text attached. I read the function that does that in Claude Code 2.1.282, and the line people search for most turns out to come from a narrow branch:

Your account does not have access to Claude. Please login again or contact your administrator.

What this exact line means

It's printed for one case only: a 403 whose message says the OAuth token has been revoked (OAuth token being the credential your /login saved). Anthropic's error reference says a revoked token means you signed out everywhere or an admin removed access.

What surprised me is that the wording depends on where Claude Code is running. In an interactive terminal the same rejection reads OAuth token revoked · Please run /login. The "does not have access" sentence is reserved for runs with nobody at a prompt: claude -p, the Agent SDK, and hosts like the desktop app. That's why so many reports of it come from the desktop app's Code tab while the terminal on the same machine is fine. Older versions said "Your organization does not have access to Claude" with the rest unchanged, and that's the wording in the April reports.

What to do about a revoked login

Sign in again. In a terminal that's /login, and the error reference suggests /logout first if the error returns in the same session. In the desktop app, sign out and back in. If you authenticate with CLAUDE_CODE_OAUTH_TOKEN, the docs say that variable keeps being sent after a rejection, so make a new token with claude setup-token.

If the line comes back immediately on a plan you're paying for, the problem is on the account side. Several people with active Max plans reported exactly that in April (two of them billed through the iOS App Store), and their issues were closed by the stale bot without an explanation from Anthropic. So I can't tell you why it happened to them. For a work account, the admin removing you is the likelier story, and only they can undo it.

“Please run /login · API Error: 403 Request not allowed”

Any 403 that isn't one of the recognized cases gets the generic treatment. In a terminal it's Please run /login · API Error: 403 followed by the server's message; with no terminal it starts Failed to authenticate. API Error: 403 instead. The message you'll usually see there is "Request not allowed". Older builds pasted the whole JSON body, which is why many reports read API Error: 403 {"error":{"type":"forbidden","message":"Request not allowed"}}.

Anthropic's troubleshooting page has a section for that one. Pro and Max users should confirm the subscription is active at claude.ai/settings. Console users need the "Claude Code" or "Developer" role, which an admin assigns under Settings, then Members. And a corporate proxy can get in the way.

A bare “403 Forbidden”

When the 403 body is a web page rather than JSON, Claude Code prints the page's title, and with no title it falls back to the status name, so you get API Error: 403 Forbidden. Anthropic documents its API errors as JSON, so an HTML page came from something on the way there. The same troubleshooting page says a 403 on the connectivity check is usually a proxy or network filter blocking the host, or Claude Code being unavailable in your region. /login won't fix either, whatever the prefix says.

When your organization has switched something off

Two 403s name an organization setting outright. One is Your organization has disabled Claude subscription access for Claude Code · Use an Anthropic API key instead, or ask your admin to enable access. The docs call it server-side: logging in again with the same account returns the same error. The other starts Your organization has disabled API key authentication, with a tail that depends on where the key came from, such as "Unset ANTHROPIC_API_KEY and run /login" when it's the environment variable.

If you're on Bedrock, Vertex, Foundry or a Claude apps gateway, a 403 gets that provider's own message instead of any of these. The gateway's version is the most candid line in the set: Gateway refused the request · signing in again won't change this.

For the 401s, which mean the credential itself was bad, see Not logged in · Please run /login and OAuth token has expired.