Alert on an Unexpected auth_success Notification

An auth_success notification mid-session means some connected service just finished an OAuth flow — expected if the human just clicked through one, worth a second look if it happened without anyone noticing a prompt for it.

Notification & Escalation Routing Event: Notification Claude Code Open source · Free

1. Save this as the hook script

#!/usr/bin/env python3
"""Notification hook — flags an auth_success notification.
Wire with matcher "auth_success"."""
import json, sys

data = json.load(sys.stdin)
print(f"NOTICE: auth_success notification received: {data.get('message', '')}. "
      f"Confirm this OAuth completion was expected.", file=sys.stderr)
sys.exit(1)

Save to a path inside your project, e.g. .claude/hooks/alert-unexpected-auth-success.sh, then chmod +x it.

2. Wire it into .claude/settings.json

{
  "hooks": {
    "Notification": [
      {
        "matcher": "auth_success",
        "hooks": [
          {"type": "command", "command": "python3 .claude/hooks/alert-unexpected-auth-success.py"}
        ]
      }
    ]
  }
}

Before you use this

A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.

Related hooks

Route Permission-Prompt Notifications to a Webhook
Posts a permission_prompt notification to a configured webhook instead of leaving it only…
Dedupe Repeated Idle-Prompt Notifications
Suppresses repeat idle-prompt notifications after the first, logging a count instead.
Escalate Quota Auto-Resume Events to an Ops Log
Tracks quota_auto_resume_fired notifications separately — a reliability signal for unatte…
Log Every Elicitation Dialog Shown to a Human
Tracks every time an MCP server's elicitation request actually reached a human-facing dia…
← All hooks
FEEDBACK