---
title: "`fly auth logout` is now less likely to bite you"
description: "fly auth logout now only revokes your locally stored token, not FLY_API_TOKEN or FLY_ACCESS_TOKEN."
date: "2026-09-22"
author: "Philipp Winter"
url: "https://fly.io/changelog/fly-auth-logout-fix/"
discussion: "https://community.fly.io/t/fly-auth-logout-is-now-less-likely-to-bite-you/28684"
---

# `fly auth logout` is now less likely to bite you

`fly auth logout` behaves weirdly. In general, it revokes and deletes the locally stored tokens created by `fly auth login`. But if you have `FLY_API_TOKEN` or `FLY_ACCESS_TOKEN` set, it revokes those instead—and ignores the stored token! Its behavior is best understood as “revoke whatever token takes precedence” and it has bitten lots of folks, including myself. It’s time to fix it. 

As of [version 0.4.106](https://github.com/superfly/flyctl/releases/tag/v0.4.106), we taught `fly auth logout` to *only* revoke and delete the locally stored token, making it the strict inverse of `fly auth login`. If you have `FLY_API_TOKEN` or `FLY_ACCESS_TOKEN` set while logging out, `flyctl` now warns that these tokens won’t be revoked.

Some of you may have relied on `fly auth logout` revoking whatever token was supplied via the environment. For that, we added a new subcommand, `fly tokens revoke supplied`, which revokes the tokens supplied via `--access-token`, `FLY_ACCESS_TOKEN`, or `FLY_API_TOKEN`, in that order.