Tell HN: Claude Code queries raw GitHub token on startup
It's probably known but I was caught off guard yesterday when I noticed that Claude Code (CC) runs `gh auth token --hostname github.com` on every startup which typically returns raw token. e.g.
$ gh auth token --hostname github.com
gho_0000000000000000000000000000000000000000
I noticed this behaviour by chance when I configured gh to use 1Password for auth[1] and I kept getting prompted by 1Password for authorization repeatedly even when just launching an empty CC session.
I don't feel comfortable my GH token being read like that and since I use Nix to manage my system I quickly wrapped `gh auth token ..`[2] to return a fake token and so far nothing breaks.
However, I'd be interested to learn why is this behaviour the way its, does anybody have a clue?
[1] https://www.1password.dev/cli/shell-plugins/github
[2] via pkgs.symlinkJoin
I guarantee it's a convenience feature. Having a Github token available make using Github significantly easier for Claude. I only use the web interface, and Claude frequently cannot access Github repos or issues, or gets rate limited. If Claude has a token, it can authenticate and not run into this annoying problem.
Interesting. Easier than the gh cli?
I don't personally use gh myself, the only reason I installed it in the first place is because I noticed claude code attempts to find it any time it's interacting with GitHub.
To be clear I don't assume ill intent here, I'm just baffled as is to why