Andrushika opened a new pull request, #76287: URL: https://github.com/apache/airflow/pull/76287
## Why `airflowctl auth login` saves two things for an environment. It writes the API URL to `<env>.json` in `AIRFLOW_HOME`. It stores the token in the keyring. Later commands read the URL from the file and the token from the keyring. Login writes the URL first. If no new token reaches the keyring after that, the token of an earlier login stays next to the new URL. This happens in two cases: - `auth login --skip-keyring` never writes to the keyring. - `keyring.set_password` fails, for example with a wrong password for an encrypted keyring. The next command then sends the old token to the new URL. I checked both cases on main with the real CLI and a small HTTP server. The new server got `Authorization: Bearer OLD_TOKEN` both times. ## What `Credentials.save()` now removes the stored token of the environment before it writes the URL. If the keyring has no token or no backend, login continues. If the removal fails for another reason, login stops and the URL does not change. After `--skip-keyring`, commands need `AIRFLOW_CLI_TOKEN` or `--api-token`, as the docs already say. Debug mode does not use the keyring, so it does not change. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 5.5) Generated-by: Claude Code (Opus 5.5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
