Claude Code headless MCP auth reminder: Sume key vs OAuth expiry

For an unattended Claude Code run, connect Sume with an API key instead of OAuth. Sume's hosted OAuth access token lasts one hour and the server does not implement refresh, so a long headless job would eventually need a fresh interactive sign-in; an API key does not expire on that clock.

Claude Code 2.1.286's changelog says it fixed headless sessions repeating the "MCP servers require authentication" reminder after a successful re-authentication when the MCP discovery cache is enabled. Sume details are from MCP OAuth and API keys and the OAuth package source, read 2026-10-01.

What did the Claude Code fix change?

Only the repeated reminder: after you re-authenticated, a headless session with the discovery cache on kept printing it. The fix does not make a token last longer, and a headless run has nobody to click through consent anyway.

How long does a Sume OAuth token last?

MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS is 60 * 60, one hour. The registration code notes that clients such as Cursor advertise refresh_token, but the server ignores it because refresh is not implemented yet and it only stores authorization_code. Plan on a re-consent after an hour.

How do I run headless with a key?

Send the key as a bearer header from an environment variable, never inline in a committed config; the docs call API-key remote MCP the path for automation that does not speak OAuth. Writes still need an idempotency_key. A config example is in headless MCP config for video.