Enum AuthErrorKind 

pub enum AuthErrorKind {
    NotAuthenticated,
    Expired,
    InvalidCredentials,
    RateLimit,
    ProviderError,
    Other,
}

Best-effort classification of an auth-related CLI failure.

Returned by classify_failure. Hosts can use it to surface a cleaner message (“run claude login”) instead of dumping CLI stderr, or to skip retry policies on errors that won’t resolve on their own.

Conservative on purpose: false positives turn legitimate non-auth failures into “auth error” surprises, so the classifier prefers to miss an auth error than to misclassify a non-auth one. Use AuthErrorKind::Other only when stronger signals (HTTP status strings, the literal word “auth”) fire.

Variants

NotAuthenticated

No credentials at all – the user has not run claude login and has no env auth set. Fix: run claude login or set one of the env vars listed in AuthStrategy.

Expired

Stored OAuth/session credentials existed but are expired. Fix: re-run claude login.

InvalidCredentials

Credentials were presented but rejected. Most often a wrong or revoked ANTHROPIC_API_KEY, or an CLAUDE_CODE_OAUTH_TOKEN that no longer maps to a valid session.

RateLimit

Authenticated but the request was rejected for rate limit / quota / billing reasons. Different remediation: wait, top up, or switch keys – not “log in again.”

ProviderError

Bedrock or Vertex provider error (cloud creds missing or rejected). Distinct because the fix lives in the cloud provider’s auth, not in claude login.

Other

Looked auth-shaped (HTTP 401/403, the word “auth”, etc.) but didn’t match any of the more specific patterns. Useful for callers that want “is this an auth thing?” without needing to know the exact subcategory.

Implementations

impl AuthErrorKind

pub fn as_str(self) -> &'static str

Stable string label, useful for logs and protocol payloads. Matches the serde_json representation.

Trait Implementations

impl Clone for AuthErrorKind

fn clone(&self) -> AuthErrorKind

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for AuthErrorKind

impl Debug for AuthErrorKind

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for AuthErrorKind

impl PartialEq for AuthErrorKind

fn eq(&self, other: &AuthErrorKind) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for AuthErrorKind

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for AuthErrorKind