fly auth logout behaves weirdly. In general, it revokes and deletes the locally stored tokens created by fly auth login. But if you have FLY_API_TOKEN or FLY_ACCESS_TOKEN set, it revokes those instead—and ignores the stored token! Its behavior is best understood as “revoke whatever token takes precedence” and it has bitten lots of folks, including myself. It’s time to fix it.

As of version 0.4.106, we taught fly auth logout to only revoke and delete the locally stored token, making it the strict inverse of fly auth login. If you have FLY_API_TOKEN or FLY_ACCESS_TOKEN set while logging out, flyctl now warns that these tokens won’t be revoked.

Some of you may have relied on fly auth logout revoking whatever token was supplied via the environment. For that, we added a new subcommand, fly tokens revoke supplied, which revokes the tokens supplied via --access-token, FLY_ACCESS_TOKEN, or FLY_API_TOKEN, in that order.