fix(auth): honor APIFY_TOKEN env var over stored login token

[l2ysho]

What

Makes the APIFY_TOKEN environment variable take precedence over the token stored by apify login. It was being silently ignored, so:

• APIFY_TOKEN=<customer_token> apify run failed with ApifyApiError: Insufficient permissions for the Actor run.
• APIFY_TOKEN=<customer_token> apify actors ls returned Actors from the logged-in account, not the token's account.

Why

Two independent causes produced the same symptom:

1. resolveToken (src/lib/utils.ts) — the single choke point behind getLoggedClient / getApifyClientOptions (~50 commands) resolved only an explicitly-passed token, then fell straight through to the stored token. It never consulted process.env.APIFY_TOKEN. This gap is longstanding (predates the keyring refactor, which faithfully preserved it).

2. apify run (src/commands/run.ts) — the stored token was injected into the child env after process.env ({ ...process.env, ...localEnvVars }), overwriting an inherited APIFY_TOKEN. The merge order was intentionally flipped in fix: prevent modifying local input.json file #1042 so the CLI's input-key redirect vars win over inherited ones; that flip also caught the token as collateral damage.

Change

Precedence is now, everywhere: explicit --token arg → APIFY_TOKEN env var → stored login token.

• resolveToken returns process.env.APIFY_TOKEN before falling back to the stored token.
• apify run only injects the stored token when APIFY_TOKEN isn't already inherited — leaving fix: prevent modifying local input.json file #1042's input-key redirect behavior fully intact.

Tests

• Local unit tests (test/local/lib/credentials.test.ts) — precedence at getApifyClientOptions: env var wins over stored, explicit arg wins over env var, stored token used when neither is set.
• [api] regression test (test/local/commands/run.test.ts) — sets an inherited APIFY_TOKEN distinct from the stored token and asserts the spawned Actor sees the inherited one.

Reviewer notes

• The keyring work (feat(auth): use os keyring for secure credential storage #1148) is unrelated — it changed where secrets are stored, not the precedence. The apify run regression traces specifically to fix: prevent modifying local input.json file #1042 (2026-04-28).
• apify run still sources proxy / userId from the stored account; only the token honors the env override. Out of scope for this fix (the reported bug is token-only).

🤖 Generated with Claude Code