🐛 Fix `FASTAPI_CLOUD_TOKEN` always overrides user token by YuriiMotov · Pull Request #174 · fastapilabs/fastapi-cloud-cli

YuriiMotov · 2026-04-02T20:07:45Z

For now, if you have FASTAPI_CLOUD_TOKEN set and try to use any command, it will always use deploy token (see sources)

This PR makes it only use FASTAPI_CLOUD_TOKEN for deploy command.

For this we need to introduce a way for Identity to know in which context it's used (whether it's a deploy command or not).

Each command can set a context (for now just prefer_auth_mode) and we should always access Identity via ctx.get_identity() (except the case with Sentry init as it's run on import time before setting the context).

Now if user runs fastapi login and FASTAPI_CLOUD_TOKEN is set, it will receive a warning:

fastapi login

And on fastapi deploy command, we also notify that deployment token is being used:

fastapi deploy

As a side effect I updated the output of whoami command.
Now it checks both user token and deployment token:

Details

Not logged in, but deployment token is set:

No credentials found. Use `fastapi login` to login.
⚡ Using API token from environment variable for `fastapi deploy` command.

Logged in, and deployment token is set:

⚡ somebody@example.com
⚡ Using API token from environment variable for `fastapi deploy` command.

Without deployment token:

⚡ somebody@example.com

Additionally added a unset_env_vars fixture that ensures FASTAPI_CLOUD_TOKEN set on host machine doesn't break tests (currently on master tests will fail if you have FASTAPI_CLOUD_TOKEN set)

…el commands

YuriiMotov · 2026-04-03T08:54:53Z

src/fastapi_cloud_cli/utils/auth.py


    def is_expired(self) -> bool:
-        if not self.token:
+        if self._auth_mode != "user":  # pragma: no cover  # Should never happen


We can add unit tests for this class and cover this case there

…tests

YuriiMotov · 2026-04-03T09:43:26Z

src/fastapi_cloud_cli/commands/deploy.py

-    identity = Identity()
+    # Duplicate context initialization here to make `fastapi deploy` command work
+    # (callback doesn't take effect in this case)
+    ctx.initialize(prefer_auth_mode="token")


For fastapi cloud ... commands context will be initialized by callback, but it doesn't work for fastapi ... commands (can't use callback when app is added without name).
To fix this we need to duplicate this initialization in commands that are used on top level (fastapi login and fastapi deploy).
Not sure if we can handle this in a better way...

YuriiMotov · 2026-04-03T10:13:50Z

src/fastapi_cloud_cli/utils/sentry.py

 def init_sentry() -> None:
    """Initialize Sentry error tracking only if user is logged in."""
-    identity = Identity()
+    identity = Identity(


Here we can't use ctx.get_identity() as this function is called at import time

YuriiMotov · 2026-04-03T10:16:40Z

tests/conftest.py

+@pytest.fixture(autouse=True)
+def unset_env_vars(monkeypatch: pytest.MonkeyPatch) -> Generator[None, None, None]:
+    """Fixture to unset environment variables that might interfere with tests."""
+    monkeypatch.delenv("FASTAPI_CLOUD_TOKEN", raising=False)
+    yield


That was very annoying that tests stopped working when I had FASTAPI_CLOUD_TOKEN set on my machine.. Took me time to understand what is happening..

YuriiMotov · 2026-04-03T10:18:07Z

tests/test_cli_deploy.py

+@pytest.mark.parametrize(
+    "command",
+    [
+        ["deploy"],
+        ["cloud", "deploy"],
+    ],
+)


Should we configure all tests for fastapi deploy and fastapi login commands to also run with fastapi cloud deploy and fastapi cloud login?

We need at least this one for coverage (to trigger condition in the callback)

YuriiMotov · 2026-04-03T10:20:33Z

tests/test_sentry.py

+def test_init_sentry_when_deployment_token(
+    logged_out_cli: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setenv("FASTAPI_CLOUD_TOKEN", "deployment-token")
+    with patch("fastapi_cloud_cli.utils.sentry.sentry_sdk.init") as mock_init:
+        init_sentry()
+
+        mock_init.assert_called_once_with(
+            dsn=SENTRY_DSN,
+            integrations=[ANY],  # TyperIntegration instance
+            send_default_pii=False,
+        )


This is not necessary for this PR, I just noticed that this use case wasn't covered by tests

Copilot

Pull request overview

This PR fixes authentication precedence so that FASTAPI_CLOUD_TOKEN (deployment token) is only preferred for deploy operations, while other commands continue to use the user token from the auth config. It introduces a global CLI context (ctx) to control Identity behavior per command context and updates multiple commands/tests accordingly.

Changes:

Introduce fastapi_cloud_cli.context.ctx to initialize per-command auth preference and access Identity via ctx.get_identity().
Update Identity to track both user_token and deploy_token, selecting the effective token based on prefer_auth_mode.
Expand CLI/test behavior: warnings for login, informational output for deploy/whoami, and add fixtures/tests around env token behavior.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/test_sentry.py	Adds coverage for Sentry init when a deployment token is set.
tests/test_cli_login.py	Adds login test ensuring deploy token env var doesn’t override user login, and warning is printed.
tests/test_cli_deploy.py	Parameterizes deploy test to cover both `fastapi deploy` and `fastapi cloud deploy`, and asserts env-token info output.
tests/test_api_client.py	Initializes `ctx` for API client tests (currently only in this file).
tests/conftest.py	Adds autouse fixture to unset `FASTAPI_CLOUD_TOKEN` during tests.
src/fastapi_cloud_cli/utils/sentry.py	Uses `Identity(prefer_auth_mode="token")` for import-time Sentry init behavior.
src/fastapi_cloud_cli/utils/cli.py	Switches unauthorized handling to use `ctx.get_identity()` and removes direct `Identity()` usage.
src/fastapi_cloud_cli/utils/auth.py	Refactors `Identity` to support user vs deploy token selection without always overriding.
src/fastapi_cloud_cli/utils/api.py	Uses `ctx.get_identity()` for API client auth header creation.
src/fastapi_cloud_cli/context.py	Adds new `Context` singleton to store `prefer_auth_mode` and construct `Identity`.
src/fastapi_cloud_cli/commands/whoami.py	Updates `whoami` to work with context/dual-token output messaging.
src/fastapi_cloud_cli/commands/setup_ci.py	Uses context-provided identity.
src/fastapi_cloud_cli/commands/logs.py	Uses context-provided identity.
src/fastapi_cloud_cli/commands/login.py	Initializes context for root login command and warns if deploy token env var is set.
src/fastapi_cloud_cli/commands/link.py	Uses context-provided identity.
src/fastapi_cloud_cli/commands/env.py	Uses context-provided identity across env subcommands.
src/fastapi_cloud_cli/commands/deploy.py	Initializes context with `prefer_auth_mode="token"` for deploy and prints env-token info.
src/fastapi_cloud_cli/cli.py	Adds `cloud_app` callback to initialize context based on invoked subcommand.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

tests/conftest.py

src/fastapi_cloud_cli/utils/sentry.py

src/fastapi_cloud_cli/commands/whoami.py

tests/test_cli_deploy.py

YuriiMotov added 9 commits April 2, 2026 21:01

Add prefer_auth_mode param to Identity

721b10f

Add Context to tell wich token to use in each command

83738d1

Add tests for sentry init with deployment token only

f109a3b

Initialize token in app callback

aec339c

Add test for login when deploy token is set

90e662b

Notify when deploy token is used

f59a0c6

Refactor Identity to store deploy token even if unused

737215a

Remove callback for top level app (doesn't work), add init to top lev…

b3c1452

…el commands

Warn on login command when deploy token is set

092f407

YuriiMotov force-pushed the login-and-token branch from ae3e143 to 092f407 Compare April 3, 2026 08:42

github-actions bot and others added 2 commits April 3, 2026 08:42

🎨 Auto format

1d3293a

Fix typing issues

5a15e8d

YuriiMotov commented Apr 3, 2026

View reviewed changes

YuriiMotov and others added 5 commits April 3, 2026 11:33

Improve the output of whoami command

0dcf573

Add unset_env_vars fxture to ignore FASTAPI_CLOUD_TOKEN breaking …

0a0cde4

…tests

Configure test to run with deploy and cloud deploy (for coverage)

730a42f

Fix coverage

a2752e6

🎨 Auto format

c737d50

YuriiMotov added the bug Something isn't working label Apr 3, 2026

YuriiMotov changed the title ~~Only use deploy token for deploy command~~ 🐛 Fix FASTAPI_CLOUD_TOKEN always overrides user token Apr 3, 2026

YuriiMotov commented Apr 3, 2026

View reviewed changes

YuriiMotov marked this pull request as ready for review April 3, 2026 10:24

YuriiMotov requested review from buurro and Copilot April 3, 2026 10:24

Copilot started reviewing on behalf of YuriiMotov April 3, 2026 10:33 View session

Copilot AI reviewed Apr 3, 2026

View reviewed changes

tests/conftest.py Show resolved Hide resolved

src/fastapi_cloud_cli/utils/sentry.py Show resolved Hide resolved

src/fastapi_cloud_cli/commands/whoami.py Outdated Show resolved Hide resolved

tests/test_cli_deploy.py Outdated Show resolved Hide resolved

YuriiMotov added 2 commits April 3, 2026 14:21

Address review comments from Copilot

12a7d06

Fix changed behavior for fastapi cloud command without subcommand

653d704

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🐛 Fix `FASTAPI_CLOUD_TOKEN` always overrides user token#174

🐛 Fix `FASTAPI_CLOUD_TOKEN` always overrides user token#174
YuriiMotov wants to merge 18 commits intomainfrom
login-and-token

YuriiMotov commented Apr 2, 2026 •

edited

Loading

Uh oh!

YuriiMotov Apr 3, 2026

Uh oh!

YuriiMotov Apr 3, 2026

Uh oh!

YuriiMotov Apr 3, 2026

Uh oh!

YuriiMotov Apr 3, 2026

Uh oh!

YuriiMotov Apr 3, 2026 •

edited

Loading

Uh oh!

YuriiMotov Apr 3, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

YuriiMotov commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

YuriiMotov Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

YuriiMotov Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

YuriiMotov Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

YuriiMotov Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

YuriiMotov Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

YuriiMotov Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

YuriiMotov commented Apr 2, 2026 •

edited

Loading

YuriiMotov Apr 3, 2026 •

edited

Loading