18.17 How today's tools realize it
- Approved by
- Panaversity ·
Reference. Skim it now, and come back after Sitting 4.
In everyday life. Every passport follows one international standard, so any border can read any passport, though each country adds its own stamps and its own lines at the airport. Concepts 18.1 to 18.16 taught the standard. This concept says, in plain words, how today's AI apps follow it, as of November 2, 2026.
What you will learn. How today's AI apps follow the sign-in rules, and the four things that change a decision.
Why it matters. The connector stays the same whichever app signs in, but each app reaches it a little differently.
What you need from this concept. Four things that change a decision:
- The connector never changes, whichever AI app signs in. It checks standard tokens against standard public keys.
- Only approved app makers' documents are accepted. Brightline's list starts with OpenAI, which makes Codex (
chatgpt.com), so Codex works as it is. - Claude Code and OpenCode are pre-registered in the lab, with a client ID you create (18.5). Field guides F5 and F7 show both ways.
- Claude Code says it cannot sign in without a browser, and Codex and OpenCode do not document a way, so automated checks need their own route (field guide F8).
How do the three coding agents compare?
Each was read on its maker's own pages. "Not documented" means the authors did not find it there, not that the agent cannot do it. Your lab notes are the real test.
| What happens | Claude Code1 | Codex2 | OpenCode3 |
|---|---|---|---|
| Signs in through your browser when the connector asks | Yes | Yes | Yes |
| Can describe itself with its own document (18.5) | Yes | Yes | Yes, unless you give it a client ID |
| Can use a client ID you created (pre-registration) | Yes | Yes | Yes, and tries this first |
| Checks the sign-in server's name before swapping the code (18.4) | Yes | Yes | Not documented |
| Gets a fresh token by itself when one runs out | Yes, and retries once | Not documented | Yes |
| After a 403 for a missing permission (18.7) | Shows that more permission is needed | Not documented | Not documented |
| Signs in with no browser, for automated checks | No | Not documented | Not documented |
What about programs that call a connector directly?
Anthropic's and OpenAI's programming interfaces (APIs, the doors for programs from Chapter 17) can also call a connector, but they do not run a sign-in. Your program gets the token and passes it in. Chapter 20 builds an agent that holds tokens for each person and company.
Where does Brightline's sign-in server run?
On a Cloudflare Worker, using Better Auth, with its records in a D1 database (field guides F2 and F3). Other ways would serve the same connector unchanged: Cloudflare's own sign-in library, or a company that runs sign-in for you for a monthly fee.
Watch this. A newer standard called DPoP ties a token to a secret held by the AI app, so a stolen token is useless on its own. The MCP specification does not require it yet. Brightline does not use it.
The invariant. The connector never trusts a request because of where it came from or what it says about itself. It trusts a token issued for it, by its own sign-in server, still in date, and it takes the company from that token alone.
Exam note. For exam takers. The Claude developer certification exam (CCDV-F) asks about Claude's behavior. Where Claude Code's documented behavior differs from the specification, the answer that scores is Claude Code's behavior.
The details. The exact behavior of each product, with its sources, is in field guide F10.
Check yourself
Question 1 / 2
0 answered
What does Claude Code do when the connector answers 401 to a request carrying a token?
Sources
- Owner
- Panaversity