[sentry-junior]

Closes #1553.

Until now, if you had both a stored login and SENTRY_AUTH_TOKEN/SENTRY_TOKEN, every command ignored one of them. With this change the env token acts as one more account: read-only, never stored, and only sent to its own server. That only happens when its server comes from a trusted source: the token's sntrys_ claim, SENTRY_HOST/SENTRY_URL from the boot env, or SaaS when neither is set. Everything else keeps today's behavior.

Behavior (follows the answers on the issue: env token wins, switching stays implicit, show the /auth/ user)

• Org routing: when the org cache shows the env token can access the target org, the command uses the env token, even if the active stored account can access it too. Orgs it can't access stay with the stored accounts. Without a target org, the stored login still wins over the env token, as fixed in update_issue returns API errors but operations succeed #646.
• Server selection: with SENTRY_HOST/SENTRY_URL set, the env token is used for that server when no stored account is on it.
• sentry org list lists the env token first, as env:SENTRY_AUTH_TOKEN. An org it shares with a login is listed under it, which matches what routing will pick. The label includes the token's user from /auth/ when the server returns one (skipped for org auth tokens). --account env:SENTRY_AUTH_TOKEN lists only the env token's orgs. With only an env token, the output doesn't change.
• sentry auth list / sentry auth status show the env token with its server and user. sentry auth switch can't select it.
• SENTRY_FORCE_ENV_TOKEN=1 still means "use only the env token".

Trust model. The env-token host snapshot now records which token was present at boot. A token added later, like a .sentryclirc [auth] token copied in by the shim, isn't scoped by that snapshot, so it doesn't become an account and keeps its fallback-only role. withEnvAccount() (the counterpart of withStoredAccount()) runs work under an env copy with the token forced and SENTRY_URL pinned to its trusted host. That way a .sentryclirc or pasted URL can't move it to another server.

Tradeoff for review. Org routing only learns which orgs the env token can access from the org cache, mostly filled by sentry org list. Because the env token wins for those orgs, an org auth token (sntrys_) whose org is cached will also be used for that org's non-build commands, where its scopes may be too narrow. That follows from the "env token wins" decision. If it's a problem in practice, we can restrict the precedence to user tokens.

via byk.

--

View Junior Session in Sentry

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
sentry-local	Skipped		Oct 20, 2026 4:14pm UTC

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1eaacd7. Configure here.}