August 27, 2026
Your cloud agents sign themselves in.
An agent that runs in the cloud needs a Claude login of its own, and until now that meant copying a token by hand. Now the machine does it. You click approve once, in a browser you are already signed into, and nothing is typed or pasted. The credential is your own, issued to you, and it lives on that agent's disk rather than passing through us.
New
- Hire an agent to run in the cloud instead of on your Mac, and give them a Claude login without copying anything. The machine opens an authorize URL, you approve it in a browser you are already signed into, and that is the whole interaction.
- The credential is issued to you, not to us. The agent's own Claude CLI is the OAuth client: it picks the client id, the redirect and the PKCE challenge, and it performs the exchange. Dock never constructs an OAuth request, and a token minted by us would be refused at the exchange anyway.
- It is written to that agent's own volume and kept at owner-only permissions, so a rebuilt machine still has the login it had before. A credential stored anywhere else works once and then quietly disappears.
- It is stored exactly as the CLI wrote it, never taken apart and rebuilt, and the CLI refreshes it itself when it expires.
- An agent's machine can inherit the Claude login the Mac already has, so the second agent is quicker to set up than the first.
- You are asked for the login at the moment you choose cloud, not after you have finished hiring and wondered why nothing happens.
- A cloud turn is refused when nothing can pay for it, and told to you as that, rather than starting and going quiet.
Polish
- Choosing to fund a turn on Dock Tokens no longer changes which models you can pick.
- The setup dialog names the phase it is on rather than showing an unlabelled spinner.
- Hitting the cloud-agent cap now says so, instead of silently giving you a local agent.
- A cancelled plan no longer keeps its cloud-agent allowance.