How VA OAuth authorization works
Your Claim Raven account sign-in and an optional VA.gov connection are separate. When a live VA connection is available and you choose it, VA directs you to authenticate with a verified ID.me or Login.gov account and review the permissions shown before approving access. Claim Raven does not receive or store your VA.gov, ID.me, or Login.gov password; it stores the resulting authorization tokens in encrypted form. The current checked implementation is configured for VA sandbox and demo use, so never enter real credentials into a screen identified as sandbox or demo.
Overview
Check the environment before entering credentials A sandbox or demo is for synthetic test data, not a real veteran account. Only continue with real ID.me or Login.gov credentials when the product clearly sends you to a live VA.gov authorization flow. If the connection is unavailable or the environment is unclear, stop and use VA.gov directly. Claim Raven support should never ask you to send a password, multifactor code, recovery code, authorization code, or OAuth token.
Two separate account choices
Claim Raven sign-in opens your Claim Raven account. Signing in with an email and password does not connect Claim Raven to VA.gov. VA authorization is optional. When it is available, you choose whether to start it, which permissions to approve on the VA screen, and whether to remain connected. ID.me or Login.gov verifies you for VA on the VA-hosted authorization path. Claim Raven receives the authorization result and tokens, not the password you used with that account provider. Claim Raven is an independent third-party service, not VA. Authorizing a connection does not turn Claim Raven into a VA representative or an official VA system.
What happens in the authorization-code flow
You start from a signed-in Claim Raven account The connection request is tied to your Claim Raven session and a safe return path. Starting an OAuth connection is not the same as signing in to Claim Raven. Claim Raven creates a one-time connection request The server generates a random state value and a PKCE verifier and challenge. The current implementation stores the request for ten minutes so a stale or unrelated callback is not accepted. VA handles identity verification and permission approval VA directs you to sign in through a verified ID.me or Login.gov account. Review the requested information on the VA screen. Continue only if the app name, destination, environment, and permissions are what you expect. VA returns a short-lived authorization code After approval, VA sends the browser back with a code and the original state value. Claim Raven validates the stored request and exchanges the code and PKCE verifier with the VA authorization server. Claim Raven stores authorization tokens, not your password The current service encrypts access and refresh tokens before database storage and records their expiration and granted scopes. Those tokens are used server-side for authorized VA API requests; they are not proof that every VA API or record is available.
What PKCE and state protect
PKCE creates a private verifier and a SHA-256 challenge. The challenge travels with the authorization request; the verifier is required when the code is exchanged. The random state value ties the returned callback to the connection request Claim Raven started and helps protect against request mix-ups and cross-site request forgery. The current state record expires after ten minutes and is consumed when the callback is handled. An expired, missing, or mismatched state should fail instead of connecting the wrong session. PKCE and state protect important parts of the redirect flow. They do not guarantee that a device, account, browser extension, network, vendor, or online service can never be compromised. The VA permission screen controls VA says a connected app can access only the information and permissions listed when you authorize it. Read that screen each time. Do not rely on an old Help Center list, screenshot, or marketing description because the available APIs, approval, requested scopes, and returned information can change.
Permissions and availability are not fixed
The checked Claim Raven configuration defines read-only groups for veteran verification and benefits-claim information. Appeals access is conditional, and the current code disables live appeals sync by default in production unless it is explicitly enabled. A configured scope is not a promise that VA has approved production access, that your account will be offered that permission, or that a particular record will be returned. The current repository points its OAuth and VA API base URLs to VA sandbox endpoints. Sandbox configuration and synthetic test results do not prove that a production connection is deployed. Evidence upload through the VA Benefits Intake API is a separate capability and is currently paused. Read-only OAuth authorization does not let Claim Raven file a claim, upload evidence, change a VA record, or choose a review option for you. When a Claim Raven connection is unavailable, use the current VA.gov page or other official VA route for the task. Do not wait on a beta feature when a notice or deadline requires action.
OAuth and VA Data Bridge are different
OAuth lets a connected app request current information from authorized VA APIs while the connection and required permissions remain available. VA Data Bridge is a point-in-time import you initiate from your own signed-in VA.gov session. Claim Raven stores that imported snapshot separately so you can use it after the import finishes. A Bridge snapshot is not an always-on OAuth feed. It does not prove that VA has accepted a filing, updated a record, or preserved the same data after the snapshot time. Disconnecting OAuth does not automatically delete a VA Data Bridge import, saved analysis, chat, uploaded file, report, or Claim Raven account. Those stored items and the account have separate controls or request processes.
Disconnect, revoke, and delete separately
Clear the active Claim Raven connection Use Disconnect All VA Access under Claim Raven Settings > Connections. The current service clears local tokens, granted scopes, VA identity fields, VA-derived profile fields, and per-API tokens. Remote access-token revocation is attempted on a best-effort basis. Confirm the permission in VA.gov Open VA.gov directly, go to Profile > Connected apps, and disconnect Claim Raven there when it appears. VA says this stops the app from receiving new profile information. Delete stored Claim Raven information separately Use the available delete control for a VA Data Bridge import or another saved item. Use Claim Raven's verified account-deletion process if you want the account and covered data deleted. Keep the identity accounts separate Disconnecting Claim Raven does not delete, revoke, or change your ID.me, Login.gov, or VA.gov account credentials. Manage those accounts through their official services.
Current authorization and connected-app sources
Current authorization and connected-app sources VA: Connected apps FAQs https://www.va.gov/resources/connected-apps-faqs/ VA API Platform: Working with VA APIs https://developer.va.gov/production-access/working-with-va-apis VA API Platform: Veteran Service History and Eligibility authorization https://developer.va.gov/explore/api/veteran-service-history-and-eligibility/authorization-code Claim Raven Privacy Policy https://claimraven.com/privacy-policy
Related connection and privacy guidance
Related connection and privacy guidance Read VA connected-app guidance https://www.va.gov/resources/connected-apps-faqs/ Read VA API authorization guidance https://developer.va.gov/production-access/working-with-va-apis See what Claim Raven can access /help-center/privacy-and-security/faq-what-can-claim-raven-access Disconnect Claim Raven from VA data /help-center/privacy-and-security/faq-revoke-access Delete your Claim Raven account and covered data /help-center/privacy-and-security/faq-delete-account Review Claim Raven data protection /help-center/privacy-and-security/feature-data-protection Learn why Claim Raven is not an official VA service /help-center/getting-started/faq-is-this-official-va Read the Claim Raven Privacy Policy /privacy-policy#va-disconnect Review Claim Raven Security /security