Keychain access

TokenEater reads your Claude Code login from the macOS Keychain. macOS asks once: click Always Allow. Codex uses a file, not the Keychain.

The one-time Always Allow

  1. 1

    On the Claude card of the setup window, click Authorize.

  2. 2

    macOS asks to read Claude Code-credentials. Click Always Allow.

  3. 3

    Done. The prompt doesn't come back when TokenEater updates.

Where the token comes from

The first source that works wins:

  1. The Keychain, through Apple's /usr/bin/security (the normal path)
  2. ~/.claude/.credentials.json (older Claude Code installs)
  3. Claude Desktop's config, decrypted locally
  4. A direct, silent Keychain read, as a last resort

With several Claude Code-credentials items, TokenEater uses the one holding a real login. A claude /login or account switch is picked up on the next auto-refresh, or right away with Reset connection (Refresh now keeps the current token).

What the messages mean

  • macOS refused access: allow it when macOS asks, then try again.
  • Reading the Keychain timed out (3 seconds): try again, restart TokenEater if it persists.
  • Several items, none holds a login: sign in to Claude Code again, or delete the extra item in Keychain Access.
  • Keychain locked: TokenEater retries once it's unlocked.
  • Waiting for Claude Code to refresh: nothing to do, Claude Code renews the token next time it runs.
  • Authorization needed: click Re-authorize. If it comes back, see below.

Fix a connection that won't come back

  1. 1

    In Settings -> Providers, click Check connection on the Claude card.

  2. 2

    If it fails, click Reset connection. It forgets the cache and reads every source again, keeping your settings, layouts and themes.

  3. 3

    Still stuck? Click Copy diagnostic and paste it into a GitHub issue. It never includes the token.

No need to reinstall or replay the onboarding.

Read-only

TokenEater never writes to your credentials or refreshes a token. When one expires, open Claude Code (or run claude) and TokenEater picks up the new one. Network calls: Privacy.