docs: Claude Code v2.1.312 - forceLoginMethod "console" no longer blocks the keyless sign-in; admins must deploy forceLoginOrgUUID

content/en/docs/claude-code/authentication.md

@@ -127,7 +127,8 @@ In practice, the profile stores an OAuth login while an API key is a static cred
 You don't get the choice on every machine. Claude Code creates an API key without asking in these cases:
 
 * You run against a cloud provider, such as [Amazon Bedrock, Google Cloud's Agent Platform, or Microsoft Foundry](https://code.claude.com/docs/en/third-party-integrations.md) or [Claude Platform on AWS](https://code.claude.com/docs/en/claude-platform-on-aws.md)
-* Any settings file sets [`forceLoginOrgUUID`](#restrict-login-to-your-organization), or sets `forceLoginMethod` to `"claudeai"` or `"console"`
+* Any settings file sets [`forceLoginOrgUUID`](#restrict-login-to-your-organization), or sets `forceLoginMethod` to `"claudeai"`
+* `forceLoginMethod` is `"console"` and no settings file sets `forceLoginOrgUUID`, until you retry from the error screen after a failed sign-in
 * A managed settings source on your machine, such as the managed settings file, an MDM profile, or the cached server-managed settings, exists but Claude Code [can't read it](https://code.claude.com/docs/en/managed-settings.md#invalid-entries-in-managed-settings) and no other managed source supplies a policy
 
 Unset `ANTHROPIC_API_KEY` before you sign in without a key.
@@ -140,6 +141,16 @@ After you sign in without a key, you have a profile instead of a stored API key:
 
 Everything else about profiles applies to this sign-in, including where it ranks against your other credentials, the `Profile` row you get in `/status`, and the features that need a claude.ai login. See [Anthropic profiles and federation credentials](#anthropic-profiles-and-federation-credentials).
 
+#### Stop offering the keyless sign-in on managed machines
+
+To stop Claude Code offering the [keyless sign-in](#sign-in-without-an-api-key), use your device management tooling to deploy [`forceLoginOrgUUID`](https://code.claude.com/docs/en/settings-reference#forceloginorguuid) in [managed settings](https://code.claude.com/docs/en/managed-settings.md) to each developer's machine. Set it to your [Console organization ID](https://platform.claude.com/settings/organization). Before you deploy it, make sure each developer has a [role that can create API keys](#claude-console-authentication). Once you deploy it, a developer without that role can't sign in to Console at `/login`.
+
+With only `forceLoginMethod` set to `"console"`, developers can retry a failed sign-in and choose the keyless option. Once `forceLoginOrgUUID` is deployed, the login screen drops that option, but developers can still use an [Anthropic profile](#anthropic-profiles-and-federation-credentials) they have or create with [`ant auth login`](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/authentication). After you deploy it, handle these credentials and logins on each machine:
+
+* **Keyless sign-ins**: to move a developer to an API key, have them log out and then log in to Console again, which creates the key. For a keyless sign-in, they run `claude auth logout` in their shell. For an `ant auth login` profile, they run `ant auth logout`. Claude Code refuses the session if a profile and an API key are both on the machine, so they log out first.
+* **Environment and helper credentials**: Claude Code refuses sessions that authenticate with `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN`, or `apiKeyHelper`, even when managed settings supply them. Remove those credentials, then have developers run `/login` to create a saved API key.
+* **claude.ai logins**: Claude Code [refuses a login](#restrict-login-to-your-organization) to an organization you haven't listed, including one already in use on the machine. To keep one, add it to a `forceLoginOrgUUID` array.
+
 ### Cloud provider authentication
 
 For teams using Amazon Bedrock, Google Cloud's Agent Platform, or Microsoft Foundry:

content/en/docs/claude-code/cloud-environments.md

@@ -99,10 +99,9 @@ Network secrets are available on Pro, Max, Team, and Enterprise plans. To check
 
 These requirements decide whether you can add a secret and whether the agent proxy can use it once added:
 
-* **Role**: on Pro, Max, and Team plans, you can add and delete secrets on your own environments whatever your role. On Team and Enterprise, Owners hold an organization admin role in your claude.ai organization and Admins don't, which changes what you see in these cases:
-  * **Your own environment on Enterprise**: with an organization admin role, you add and delete secrets. Without it, the **Network secrets** row opens the secrets list with the note "Only an organization admin can add or delete network secrets" and no **Add secret** or delete button. Ask an Owner to add the secret to a [shared environment](#organization-shared-environments), then run your sessions there
+* **Role**: on every plan, you can add and delete secrets on your own environments whatever your role. On Team and Enterprise, Owners hold an organization admin role in your claude.ai organization and Admins don't, which changes what you see in these cases:
+  * **Your own environment**: without an organization admin role, **Add secret** opens a [shorter form](#add-a-secret-without-the-role)
   * **A shared environment**: Owners [add and delete its secrets](#add-a-credential) from admin settings. Without an organization admin role, ask an Owner to add the secret, because the environment's dialog has no **Network secrets** section
-  * **Your own environment on Team**: without an organization admin role, **Add secret** opens a [shorter form](#add-a-secret-without-the-role) that takes one host
 * **Environment type**: an Anthropic-hosted cloud environment that already exists. A [self-hosted environment](https://code.claude.com/docs/en/self-hosted-environments) doesn't have network secrets
 * **API reachability**: the API accepts connections from the internet, because requests leave from Anthropic's network
 * **Encryption keys**: if your organization uses customer-managed encryption keys, you can't save network secrets
@@ -111,7 +110,7 @@ These requirements decide whether you can add a secret and whether the agent pro
 
 You add secrets one at a time. To change a secret's hosts or value, delete it and add it again.
 
-To add a secret to a [shared environment](#organization-shared-environments), open it for editing from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings), then continue from step 2 in its **Network secrets** section. If you're on a Team plan and don't hold an [organization admin role](#requirements), follow step 1 on your own environment, then [fill in the shorter form](#add-a-secret-without-the-role).
+To add a secret to a [shared environment](#organization-shared-environments), open it for editing from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings), then continue from step 2 in its **Network secrets** section. If you're on a Team or Enterprise plan and don't hold an [organization admin role](#requirements), follow step 1 on your own environment, then [fill in the shorter form](#add-a-secret-without-the-role).
 
 **1. Open the environment's network secrets**
 
@@ -133,9 +132,9 @@ Select **Add**. The secret appears in the list with its hosts, saved without the
 
 To confirm the secret works, start a session in the environment and ask Claude to call the API, for example with `curl`. The API answers as if the key were in the request, and the key doesn't appear in the session's environment variables or in any file. If the list marks a secret **Not sent** instead, the note under it says why and what to do. Two secrets whose hosts overlap without matching exactly get no marker, and the agent proxy sends only one of them.
 
-#### Add a secret on a Team plan without an organization admin role
+#### Add a secret without an organization admin role
 
-If you're on a Team plan and don't hold an [organization admin role](#requirements), the **Add secret** form takes one secret for one host. Select your environment's [**Network secrets** row](#add-a-credential) and then **Add secret**. Fill in these fields and select the form's **Add secret** button:
+If you're on a Team or Enterprise plan and don't hold an [organization admin role](#requirements), the **Add secret** form takes one secret for one host. Select your environment's [**Network secrets** row](#add-a-credential) and then **Add secret**. Fill in these fields and select the form's **Add secret** button:
 
 * **Host**: the one host that gets the secret, such as `api.example.com`. The form doesn't accept a `*.` wildcard
 * **Name**: an optional label for the secret

content/en/docs/claude-code/iam.md

@@ -127,7 +127,8 @@ In practice, the profile stores an OAuth login while an API key is a static cred
 You don't get the choice on every machine. Claude Code creates an API key without asking in these cases:
 
 * You run against a cloud provider, such as [Amazon Bedrock, Google Cloud's Agent Platform, or Microsoft Foundry](https://code.claude.com/docs/en/third-party-integrations.md) or [Claude Platform on AWS](https://code.claude.com/docs/en/claude-platform-on-aws.md)
-* Any settings file sets [`forceLoginOrgUUID`](#restrict-login-to-your-organization), or sets `forceLoginMethod` to `"claudeai"` or `"console"`
+* Any settings file sets [`forceLoginOrgUUID`](#restrict-login-to-your-organization), or sets `forceLoginMethod` to `"claudeai"`
+* `forceLoginMethod` is `"console"` and no settings file sets `forceLoginOrgUUID`, until you retry from the error screen after a failed sign-in
 * A managed settings source on your machine, such as the managed settings file, an MDM profile, or the cached server-managed settings, exists but Claude Code [can't read it](https://code.claude.com/docs/en/managed-settings.md#invalid-entries-in-managed-settings) and no other managed source supplies a policy
 
 Unset `ANTHROPIC_API_KEY` before you sign in without a key.
@@ -140,6 +141,16 @@ After you sign in without a key, you have a profile instead of a stored API key:
 
 Everything else about profiles applies to this sign-in, including where it ranks against your other credentials, the `Profile` row you get in `/status`, and the features that need a claude.ai login. See [Anthropic profiles and federation credentials](#anthropic-profiles-and-federation-credentials).
 
+#### Stop offering the keyless sign-in on managed machines
+
+To stop Claude Code offering the [keyless sign-in](#sign-in-without-an-api-key), use your device management tooling to deploy [`forceLoginOrgUUID`](https://code.claude.com/docs/en/settings-reference#forceloginorguuid) in [managed settings](https://code.claude.com/docs/en/managed-settings.md) to each developer's machine. Set it to your [Console organization ID](https://platform.claude.com/settings/organization). Before you deploy it, make sure each developer has a [role that can create API keys](#claude-console-authentication). Once you deploy it, a developer without that role can't sign in to Console at `/login`.
+
+With only `forceLoginMethod` set to `"console"`, developers can retry a failed sign-in and choose the keyless option. Once `forceLoginOrgUUID` is deployed, the login screen drops that option, but developers can still use an [Anthropic profile](#anthropic-profiles-and-federation-credentials) they have or create with [`ant auth login`](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/authentication). After you deploy it, handle these credentials and logins on each machine:
+
+* **Keyless sign-ins**: to move a developer to an API key, have them log out and then log in to Console again, which creates the key. For a keyless sign-in, they run `claude auth logout` in their shell. For an `ant auth login` profile, they run `ant auth logout`. Claude Code refuses the session if a profile and an API key are both on the machine, so they log out first.
+* **Environment and helper credentials**: Claude Code refuses sessions that authenticate with `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN`, or `apiKeyHelper`, even when managed settings supply them. Remove those credentials, then have developers run `/login` to create a saved API key.
+* **claude.ai logins**: Claude Code [refuses a login](#restrict-login-to-your-organization) to an organization you haven't listed, including one already in use on the machine. To keep one, add it to a `forceLoginOrgUUID` array.
+
 ### Cloud provider authentication
 
 For teams using Amazon Bedrock, Google Cloud's Agent Platform, or Microsoft Foundry:

content/en/docs/claude-code/settings-reference.md

@@ -5173,7 +5173,9 @@ Unlike [`awsAuthRefresh`](#awsauthrefresh), Claude Code always runs this command
 
 ### `forceLoginMethod`
 
-Restrict which kind of account people can log in with. Set `"claudeai"` to allow only claude.ai accounts, `"console"` to allow only Claude Console accounts, or `"gateway"` to send people to a [cloud gateway](https://code.claude.com/docs/en/claude-apps-gateway) instead of a first-party login. Administrators set it in managed settings and pair it with [`forceLoginOrgUUID`](#forceloginorguuid) to keep developers' claude.ai logins inside one organization. If you set it to `"claudeai"` or `"console"` in any settings file, Claude Code also stops offering the [keyless Console sign-in](https://code.claude.com/docs/en/authentication.md#sign-in-without-an-api-key) in the sessions that file applies to.
+Restrict which kind of account people can log in with. Set `"claudeai"` to allow only claude.ai accounts, `"console"` to allow only Claude Console accounts, or `"gateway"` to send people to a [cloud gateway](https://code.claude.com/docs/en/claude-apps-gateway) instead of a first-party login. Administrators set it in managed settings and pair it with [`forceLoginOrgUUID`](#forceloginorguuid) to keep developers' claude.ai logins inside one organization.
+
+If you set it to `"claudeai"` in any settings file, Claude Code also stops offering the [keyless Console sign-in](https://code.claude.com/docs/en/authentication.md#sign-in-without-an-api-key) in the sessions that file applies to. With `"console"` alone, people can still reach the keyless sign-in after a failed login. To stop Claude Code offering it, see [Stop offering the keyless sign-in on managed machines](https://code.claude.com/docs/en/authentication.md#stop-offering-the-keyless-sign-in-on-managed-machines), which also lists what else `forceLoginOrgUUID` changes.
 
 * **Scope**: [`Any file`](#scopes). Claude Code honors `"gateway"` from the same sources as [`forceLoginGatewayUrl`](#forcelogingatewayurl) and treats it as unset everywhere else.
 * **Type**: string, one of:

content/mcp/extensions/overview.md

@@ -119,6 +119,8 @@ A **breaking change** is any modification that would cause existing implementati
 
 Clients and servers advertise their support for extensions in the `extensions` field within their respective capability declarations.
 
+The examples below use protocol version `2026-07-28` and later. For `2025-11-25` and earlier, see [Initialization-Based Versions](#initialization-based-versions).
+
 ### Client Capabilities
 
 Clients advertise extension support in `_meta["io.modelcontextprotocol/clientCapabilities"]` within each request:
@@ -182,6 +184,67 @@ Servers advertise extension support in the `server/discover` response:
 
 Each extension specifies the schema of its settings object; an empty object indicates no settings.
 
+### Initialization-Based Versions
+
+Extensions became an official part of the protocol in version `2026-07-28`. Before that, many SDKs, clients, and servers already negotiated extensions on `2025-11-25` and earlier during the [`initialize` handshake](https://modelcontextprotocol.io/specification/2025-11-25/basic/lifecycle#initialization), using `params.capabilities.extensions` in the request and `result.capabilities.extensions` in the response. The extension identifiers and settings objects follow the same rules as above.
+
+> [!NOTE]
+>
+> The `extensions` field is not part of the published schemas for these protocol versions, and supporting it is not required for conformance. SDKs that can carry `capabilities.extensions` through `initialize` are encouraged to do so, so that extensions work consistently across protocol versions. Check that your SDK can send and receive this field, and that the extension supports the negotiated protocol version. If the other side's capabilities omit `extensions`, or omit a given extension, treat that extension as unsupported and follow [Graceful Degradation](#graceful-degradation).
+
+**Client request**
+
+Clients advertise extension support in the `initialize` request:
+
+```json theme={null}
+{
+  "jsonrpc": "2.0",
+  "id": 1,
+  "method": "initialize",
+  "params": {
+    "protocolVersion": "2025-11-25",
+    "capabilities": {
+      "roots": {
+        "listChanged": true
+      },
+      "extensions": {
+        "io.modelcontextprotocol/ui": {
+          "mimeTypes": ["text/html;profile=mcp-app"]
+        }
+      }
+    },
+    "clientInfo": {
+      "name": "ExampleClient",
+      "version": "1.0.0"
+    }
+  }
+}
+```
+
+**Server response**
+
+Servers advertise extension support in the `initialize` response:
+
+```json theme={null}
+{
+  "jsonrpc": "2.0",
+  "id": 1,
+  "result": {
+    "protocolVersion": "2025-11-25",
+    "capabilities": {
+      "tools": {},
+      "extensions": {
+        "io.modelcontextprotocol/ui": {}
+      }
+    },
+    "serverInfo": {
+      "name": "ExampleServer",
+      "version": "1.0.0"
+    }
+  }
+}
+```
+
 ### Graceful Degradation
 
 If one side supports an extension but the other doesn't, the supporting side needs to either fall back to core protocol behavior or reject the request with an appropriate error if the extension is mandatory.

content/support/10310342-how-do-i-log-out-of-all-active-sessions.md

@@ -46,7 +46,7 @@ Logging out of all active sessions also logs you out of Claude Code. To log out
 
 If you used your Claude account to authenticate into Claude Code, you can see and log out of those sign-ins in **Settings > Account**, where they're listed with your other sessions. If they aren't listed there, manage your authorization tokens in **Settings > Claude Code**. To remove a token and log out of Claude Code, click the trash can icon.
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1608263923/b4fa7d6f6f08f2adffb4ea63bc58/image+%287%29.png?expires=1793170800&signature=12cbe093d47e169af1d703524a5bc2769b37347a94cea19824406d3752a29f47&req=dSYnHst4nohdWvMW1HO4zVuHix%2F80WezAQofdwM8qVcdgO5R5MNioBB9lKiK%0A5EPIIfuLZh4kxFwFjII%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/1608263923/b4fa7d6f6f08f2adffb4ea63bc58/image+%287%29.png?expires=1793207700&signature=0825900d7cbb67d1a48537f6ae07bff2b066d3a39ea9a72e65ec1d8a6abe81bb&req=dSYnHst4nohdWvMW1HO4zVuHix%2F%2F1mC8AQofdwM8qVexec99TjlGySVkjkBE%0AyqNBOMQij%2FGvzONi%2BHw%3D%0A)
 
 ## Unable to access your account?
 

content/support/10504844-manage-user-feedback-settings-on-team-and-enterprise-plans.md

@@ -6,6 +6,6 @@ As a Primary Owner or Owner of a Team or Enterprise plan, you can manage the abi
 
 2. Use the toggle to change the **Rate chats** setting for your organization:
 
-![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2058292603/75752add0bed6a9f3ab217f01708/CleanShot%2B2026-02-12%2Bat%2B08_55_14-402x.png?expires=1793170800&signature=431aaba2a7e0c701f6559cd113d58bc44f0014e02fd4156e49a9c69866526e82&req=diAiHst3n4dfWvMW1HO4zYGm8yQdF6jE085gFtEpvcSNh4FlQ5loMj0aFwcD%0A821slBgMKsVO07%2BOGjE%3D%0A)
+![](https://downloads.intercomcdn.com/i/o/lupk8zyo/2058292603/75752add0bed6a9f3ab217f01708/CleanShot%2B2026-02-12%2Bat%2B08_55_14-402x.png?expires=1793207700&signature=0b3358996c8fc5d832db6ed212c44c312a83129de9b2c8f13ddddd363fc7aa3f&req=diAiHst3n4dfWvMW1HO4zYGm8yQeEK%2FL085gFtEpvcQKL1O8dHIAx3HI0wN%2F%0A6N2hMXn1eza8%2FiQWBew%3D%0A)
 
 More information on how Anthropic collects, uses, and stores feedback data can be found in our Privacy Center: **[How long do you store my organization’s data?](https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data)**