# Fix Claude Desktop OAuth Token Cache 401 Authentication Errors

> Resolve Claude Desktop OAuth token cache 401 authentication errors by deleting the stale oauth token entry from config json. Get Claude Desktop working again.

- Repository: [Aaddrick/claude-desktop-debian](https://github.com/aaddrick/claude-desktop-debian)
- Tags: how-to-guide
- Published: 2026-04-19

---

**Delete the stale `oauth:tokenCache` entry from `~/.config/Claude/config.json` to force a fresh OAuth flow and resolve 401 Unauthorized errors.**

The `aaddrick/claude-desktop-debian` project ports Anthropic’s Claude Desktop application to Linux, but the OAuth token cache implementation can cause persistent **401 authentication errors** when the stored access token expires. Because the Electron front-end continues to read the stale token from the user configuration file, the backend rejects requests until the cache is manually cleared.

## Understanding the OAuth Token Cache Architecture

### Where the Token Is Stored

Claude Desktop persists the OAuth access token in the user-wide configuration file located at `~/.config/Claude/config.json`. This file is loaded at startup by the launcher scripts and maintained by the Electron front-end. When authentication succeeds, the application writes the token to the `oauth:tokenCache` key inside this JSON object.

### Backend Handling in cowork-vm-service.js

The backend stack implements an `addApprovedOauthToken` method across all VM isolation layers (Host, Bwrap, and KVM), but the current implementation in [`scripts/cowork-vm-service.js`](https://github.com/aaddrick/claude-desktop-debian/blob/main/scripts/cowork-vm-service.js) treats this as a no-op:

```javascript
// scripts/cowork-vm-service.js
async addApprovedOauthToken(params) {
    log(`${this.backendName}: addApprovedOauthToken`);
    return {};                 // ← no-op implementation
}

```

*Source: lines 46-48 of [`cowork-vm-service.js`](https://github.com/aaddrick/claude-desktop-debian/blob/main/cowork-vm-service.js)*

Because the token never travels to the guest VM, it remains purely a host-side concern. This architecture means that clearing the host’s JSON cache is the complete solution for fixing 401 errors—no guest-side action is required.

## Manual Fix for 401 Authentication Errors

When the backend returns **401 Unauthorized**, the cached token has expired. Follow these steps to force a fresh OAuth flow:

1. **Close Claude Desktop completely** to ensure no background process holds the configuration file open.

2. **Edit the configuration file** using your preferred editor:

   ```bash
   nano ~/.config/Claude/config.json
   ```

3. **Locate and delete the `oauth:tokenCache` entry**. Remove the entire key-value pair, including the trailing comma if it is the last entry in the object.

4. **Save the file and restart Claude Desktop**. The application will detect the missing token and prompt you to sign in again, generating a fresh, valid entry.

These steps are documented in the project’s troubleshooting guide and were contributed by community member **MrEdwards007**.

*Source: [`docs/TROUBLESHOOTING.md`](https://github.com/aaddrick/claude-desktop-debian/blob/main/docs/TROUBLESHOOTING.md) – Authentication Errors (401)*

## Automated Token Cache Clearing

For users who prefer command-line automation, the `jq` utility can safely remove the token without manual editing:

```bash
jq 'del(.["oauth:tokenCache"])' \
    ~/.config/Claude/config.json > /tmp/config.json && \
mv /tmp/config.json ~/.config/Claude/config.json

```

This command preserves all other configuration values while atomically removing the stale token. Ensure Claude Desktop is not running when executing this script to prevent file corruption.

### Alternative Node.js Helper

You can also expose this logic as a small CLI helper:

```javascript
// scripts/clear-oauth-cache.js
#!/usr/bin/env node
const { execSync } = require('child_process');
const cfg = `${process.env.HOME}/.config/Claude/config.json`;
execSync(`jq 'del(.["oauth:tokenCache"])' ${cfg} > ${cfg}.tmp && mv ${cfg}.tmp ${cfg}`);
console.log('OAuth token cache cleared.');

```

Make it executable and run:

```bash
chmod +x scripts/clear-oauth-cache.js
./scripts/clear-oauth-cache.js

```

## Why This Fixes the 401 Error

- **Token cache removal** forces the Electron front-end to initiate a new OAuth flow, obtaining a valid access token directly from Anthropic’s servers.
- **No-op backend handling** means the token is never forwarded to guest VMs, so clearing the host-side cache is the only required remediation step.
- **Architecture isolation** keeps the token confined to the host configuration, preventing leakage into the various VM backends (Host, Bwrap, KVM) and ensuring that a simple JSON edit restores functionality.

## Summary

- Claude Desktop stores the OAuth token in `~/.config/Claude/config.json` under the key `"oauth:tokenCache"`.
- When the token expires, the application continues to use the stale value, causing **401 Unauthorized** errors.
- The `addApprovedOauthToken` method in [`scripts/cowork-vm-service.js`](https://github.com/aaddrick/claude-desktop-debian/blob/main/scripts/cowork-vm-service.js) is a no-op, confirming the token never leaves the host.
- **Fix**: Delete the `oauth:tokenCache` entry from the JSON file and restart the application to trigger a fresh OAuth flow.
- **Automation**: Use `jq 'del(.["oauth:tokenCache"])'` to programmatically clear the cache.

## Frequently Asked Questions

### What causes the 401 error in Claude Desktop?

The 401 error occurs when the OAuth access token cached in `~/.config/Claude/config.json` expires. The Electron front-end continues to present this stale token to the backend, which rejects it as invalid. Because the token is only cleared during a full logout, expired tokens can persist across sessions and cause repeated authentication failures.

### Is it safe to delete the oauth:tokenCache entry?

Yes. The `oauth:tokenCache` entry is purely a cache of the current session’s access token. Deleting it does not affect your account, conversation history, or other settings stored in the configuration file. The application will simply prompt you to sign in again and regenerate the token on the next startup.

### Does the token get forwarded to the VM backend?

No. According to the source code in [`scripts/cowork-vm-service.js`](https://github.com/aaddrick/claude-desktop-debian/blob/main/scripts/cowork-vm-service.js), the `addApprovedOauthToken` method is implemented as a no-op across all backend types (Host, Bwrap, and KVM). The token remains confined to the host-side configuration file and is never transmitted to the guest VM environment.

### How often should I clear the token cache?

You should only clear the token cache when you encounter a 401 authentication error or when the application fails to authenticate with the Claude Code backend. There is no routine maintenance benefit to clearing the cache, as the application automatically refreshes the token during normal OAuth flows. If 401 errors recur frequently, verify that your system clock is synchronized, as clock skew can cause premature token expiration.