---
title: "Some API endpoints briefly rejected flyctl requests"
---

# Some API endpoints briefly rejected flyctl requests

[← View full Infra Log](https://fly.io/infra-log/)

---

August 20: Some API endpoints briefly rejected flyctl requests (14:46UTC)

We deployed a change to one of our API backends to reject authentication using legacy OAuth “f01 *” tokens. Due to a bug, this also ended up rejecting the token “bundles” used by flyctl - these bundles include one Macaroon token per org, as well as an user-specific OAuth token which uses the same “f01* ” prefix as the legacy tokens.

We rolled out an update to the token parsing/rejection logic to allow mixed-token bundles (while still rejecting legacy tokens), and `flyctl` behavior returned to normal; we also added a code test to help catch similar issues in the future.