Claude Code scope re-authenticate prompt vs unattended Sume runs

Claude Code 2.1.288 added a re-authenticate prompt when an MCP server asks for more OAuth scope during a tool call (Claude Code changelog, read 2026-10-04). That is helpful when you are at the keyboard. In an unattended run nobody can answer it, so decide the scope before the run starts: grant mcp:write at consent, or use an API key.

Whether that prompt appears for a Sume refusal is worth testing, because Sume reports a missing scope as a tool result carrying insufficient_scope and required_scope, not as an HTTP step-up challenge.

How Sume gates writes

The hosted endpoint offers two OAuth scopes, mcp:read and mcp:write. Read is required and read-only. Write is opt-in on the consent page, where the toggle defaults to off, and granting write always includes read. There is no mcp:paid scope: paid submits are governed by wallet and admission. API keys get the full tool set (MCP OAuth and API keys).

Why a mid-run upgrade is a poor fit for automation

A prompt needs a person. A scheduled or headless job has none, so the run would stall or fail at the first write. There is a second constraint: Sume's OAuth access token lasts 3600 seconds and the server issues no refresh token, so a long-lived job on OAuth would need a fresh sign-in anyway.

A practical split

Use OAuth, read-only, for people exploring a catalog and for checks. Use an API key for jobs that must generate, stored as a secret in the runner, with the paid gates in the prompt. Keep the interactive upgrade path for a person who decides, mid-session, that a task is worth the spend.

• Unattended writer: API key, dry_run first, max_spend_usd on every call.
• Interactive helper: OAuth read-only, reconnect with Write when needed.
• Never rely on a prompt that no one will see.

If a run already hit the wall

Read the tool result, find required_scope, and change the credential rather than retrying. Retrying the same call under the same token returns the same refusal, and nothing was submitted, so there is no job to clean up.