post: claude setup-token fixed my launchd auth and dropped my connectors

[clarkbw]

Post: 2026-08-11-claude-setup-token-drops-claude-ai-connectors-gmail-calendar-headless-claude-p-launchd-keychain-oauth-token-precedence.md

Blog candidate #9. Draft only — date is the draft date (2026-08-11); script/bump.py / script/publish.py bump it at merge.

Title: claude setup-token fixed my launchd auth and dropped my connectors

The story

A scheduled headless claude -p job died on an expired keychain OAuth session. The fix — a one-year CLAUDE_CODE_OAUTH_TOKEN from claude setup-token, sourced from the job's shared env file — authenticates fine and silently removes every claude.ai account connector (Gmail / Calendar / Drive), because the token sits at rank 5 in Claude Code's auth precedence and /login sits at rank 7. Four daily runs exited 0, wrote their artifact, and were blind to email and calendar. Fix: keychain session primary with the token explicitly unset, token as an announced degraded fallback; success redefined as "an artifact newer than this run's start", checked by mtime. Bonus: the find -newermt "@$STAMP" -print -quit heartbeat that read false in-script and true by hand, replaced with ls -t + stat -f %m.

One thing changed from the brief

The behaviour is documented, not undocumented. I went looking for docs to caveat the claim against and found it stated twice, verbatim:

• Authentication § Generate a long-lived token — "It can only make model requests, so it can't establish Remote Control sessions or fetch claude.ai connectors."
• MCP § Use MCP servers from claude.ai — a four-bullet exclusion list whose last bullet is this exact case.

Both fetched and quoted verbatim. That makes the post stronger, not weaker — it's no longer "here's an undocumented bug", it's "here's a documented cost you'll pay by accident, and here's why nothing tells you". Only the claude mcp list output is flagged as my own observation (the docs describe /mcp and /status, never claude mcp list), with a version note.

SEO

Slug/description/tags carry: claude setup-token, CLAUDE_CODE_OAUTH_TOKEN, claude mcp list, claude.ai connectors Gmail / Google Calendar / Google Drive, headless claude -p, launchd, macOS keychain, authentication precedence, "OAuth session expired and could not be refreshed", Login expired · Please run /login. Per the research sweep, the genuinely unclaimed search real estate is the conjunction — the launchd fix and the connector cost are each written up separately and nobody has connected them.

Figures

• connector-auth-path.svg — the mechanism: two lanes (login session vs token), the ✕ where the account-session fetch doesn't happen, model requests fine in both.
• four-green-runs.svg — six days of runs: one loud failure, four green runs with connectors missing.

Privacy

No hostnames, no private repo names, no infra paths, no job names beyond "a daily scheduled agent job". All snippets are sanitized reconstructions (generic reports/ paths, $HOME/.agent/.env), not private file contents. Public link is naturali-agents.

Verified

python3 script/lint-liquid.py → 35 posts clean · bundle exec jekyll build → clean · both SVGs present in _site/assets/img/<slug>/ and both <img src="/assets/…"> render · all three post_url related links resolve.

Worth a check before publishing

• Precedence ranks 1–7 in the table are transcribed from the current docs page — re-confirm if the page moves.
• The post says the 07-28 outage was "an expired login session" and treats the keychain-lock theory as one candidate; the private commit trail concluded the login keychain was no-timeout and the session genuinely expired. The post deliberately doesn't relitigate it.