flyctl uses the wrong account: FLY_API_TOKEN overrides fly auth login

FLY_API_TOKEN overrides your interactive login silently. If fly auth whoami shows the wrong user, check env | grep FLY_ for a stale export, then unset FLY_API_TOKEN (or update it to the right token). The env var always wins over flyctl auth login.

$ fly auth whoami
wrong-user   # expected: your-user, right after a fresh flyctl auth login

Fix

1. Check for the override:

   env | grep FLY_

   Expected culprit: FLY_API_TOKEN set to an old or different account's token.

2. See which credential is actually active:

   fly auth token

   Compare it against the token in ~/.fly/config.yml. If they differ, the env var is winning.

3. Remove or correct it:

   unset FLY_API_TOKEN

   Expected: fly auth whoami now shows the logged-in user.

4. Make it permanent: delete the export from ~/.bashrc, ~/.zshrc, direnv files, or IDE run configs.

When this applies

• fly auth whoami disagrees with your last flyctl auth login.
• Deploys land in the wrong account or org right after switching users.

When it does NOT apply

• 401 errors: the token (whichever one is active) is dead; refresh it.
• No token anywhere: No access token available; just log in.

Compatibility

• flyctl (all recent versions).

Why it happens

Precedence is env var first, stored login second. The env var exists for CI, where there is no login, but it lingers in interactive shells from old setup instructions and then shadows every subsequent flyctl auth login with zero feedback.

Edge cases

• CI files (GitHub Actions env blocks) are a common hiding place; the local shell looks clean but the job exports it.
• fly auth token prints the secret; run it only where shoulder-surfers and logs cannot see it.
• After unsetting, the flyctl agent may still hold the old token; fly agent stop clears it.

flyctl reads FLYAPITOKEN with precedence over the token stored by 'flyctl auth login' in ~/.fly/config.yml - this is the documented CI pattern (set the env var and skip login), which means a stale export in a shell profile, IDE env config, or CI file overrides every interactive login without any warning. The flyctl cheat sheet (geekgeekgo.natcheung.com/api/v1/cheatsheets/flyctl-cli/pdf) lists the auth surface: 'fly auth login - Log in via browser', 'fly auth token - Display current auth token', 'fly auth whoami - Show currently authenticated user' - 'fly auth token' is the diagnostic that reveals which credential is actually in effect. Source: https://geekgeekgo.natcheung.com/api/v1/cheatsheets/flyctl-cli/pdf