Skip to main content

Junyi's Lab

Claude Code Asks to Re-login in tmux? It’s Probably macOS Keychain

/en/posts/tmux-keychain/ map[email:[email protected] name:Junyi Hou]
Table of Contents

claude works fine in my terminal — Team Account, auth, everything. Open tmux, run claude, and it wants me to log in again. Took a bit of digging to figure out it’s a macOS Security Session thing.

# What happens

claude in Ghostty: works. claude in tmux: asks to re-login.

How I tracked it down (click to expand)

## Environment variables?

First thought: tmux has different env vars.

env | grep -iE 'claude|anthropic'

Nothing on either side. Claude Code doesn’t store auth in env vars.

## Config files?

cat ~/.claude/.credentials.json 2>/dev/null || echo "no credentials file"

Nope. Not on disk either.

## Keychain

security dump-keychain 2>&1 | grep -i -A3 'claude\|anthropic'

Found it — stored in macOS Keychain as Claude Code-credentials:

0x00000007 <blob>="Claude Code-credentials"
"acct"<blob>="junyi"
"svce"<blob>="Claude Code-credentials"
keychain: "/Users/junyi/Library/Keychains/login.keychain-db"

Then:

security find-generic-password -s "Claude Code-credentials" -a "junyi" -w

Works in the terminal, errors in tmux. There it is.

# Why this happens

macOS Keychain access is tied to a Security Session (Bootstrap Namespace). When you open a terminal window, the process gets attached to your Aqua session, which holds the Keychain unlock state.

tmux server is a long-running daemon — it starts on your first tmux new and stays alive. When you tmux attach later, shells forked inside tmux server inherit the server’s original session, not your current Aqua session.

Normal terminal:
  Ghostty → fork shell → inherits Aqua session → ✅ Keychain works

tmux:
  Ghostty → attach → tmux server (old process)
                       → fork shell → inherits old session
                                       → ❌ Keychain blocked

Same reason pbcopy/pbpaste break inside tmux.

# Fix

Install reattach-to-user-namespace to reconnect tmux processes to your Aqua session:

brew install reattach-to-user-namespace

Add to ~/.tmux.conf:

set-option -g default-command "reattach-to-user-namespace -l ${SHELL}"

Then kill the entire tmux server (kill-session won’t help — new windows still fork from the old server):

tmux kill-server
tmux new -s main

Verify:

security find-generic-password -s "Claude Code-credentials" -a "$USER" -w 2>&1 | head -c 50

If it prints the token, you’re good.

# While you’re at it

These tmux issues are probably the same root cause:

  • pbcopy/pbpaste broken
  • ssh-agent inaccessible
  • osascript failing
  • gh auth, op, and other Keychain-dependent CLI tools not working

reattach-to-user-namespace fixes all of them.

Read next