Account incorrectly reported active in gh auth status

Describe the bug

Running gh auth status reports account as active, but API calls use another account.

> gh --version
gh version 2.63.0 (1980-01-01)
https://github.com/cli/cli/releases/tag/v2.63.0

Steps to reproduce the behavior

You have two users on same hostname github.com, last active account is user1.
Switch to another folder with custom GH_CONFIG_DIR (via direnv), with a custom config which has one user user2
Run gh auth status

> gh auth status
github.com
  ✓ Logged in to github.com account user2 (keyring)
  - Active account: true
  - Git operations protocol: ssh
  - Token: gho_************************************
  - Token scopes: 'gist', 'read:org', 'repo', 'workflow'

Run gh api /user | jq .name => prints user1, contradicting auth status output

The expected behavior is to use the token for the given host+user of current repository without needing to gh auth switch, and report active account correctly.

Context

Active token is fetched from keyring using only hostname

cli/internal/config/config.go

Lines 202 to 218 in 5402e20

    
           // ActiveToken will retrieve the active auth token for the given hostname, 
        
           // searching environment variables, plain text config, and 
        
           // lastly encrypted storage. 
        
           func (c *AuthConfig) ActiveToken(hostname string) (string, string) { 
        
           	if c.tokenOverride != nil { 
        
           		return c.tokenOverride(hostname) 
        
           	} 
        
           	token, source := ghauth.TokenFromEnvOrConfig(hostname) 
        
           	if token == "" { 
        
           		var err error 
        
           		token, err = c.TokenFromKeyring(hostname) 
        
           		if err == nil { 
        
           			source = "keyring" 
        
           		} 
        
           	} 
        
           	return token, source 
        
           }

Related to #9111 (comment))

@williammartin

Hello @williammartin, for your question about using GH_CONFIG_DIR with direnv, I prefer separating accounts config and I like git includeIf pattern.

# ~/.gitconfig
[includeIf "gitdir:~/dev/org1/"]
  path = ~/dev/org1/.gitconfig
[includeIf "gitdir:~/dev/org2/"]
  path = ~/dev/org2/.gitconfig

For gh I had to use direnv to achieve this, and also I prefer gh auth status to only report one account, which is the one I'm expecting in my filesystem context.

Interesting issue... I have been able to repro this, and it looks like it actually might be an issue with how GH_CONFIG_DIR is working alongside gh api... It seems that gh api is not respecting the custom config pointed to by the GH_CONFIG_DIR env var. I suspect that it's defaulting to the global config before falling back to the specified config.

Repro steps

Log out of all accounts
Create a new repo
Create a new config in that repo mkdir .config
Log into account 1 and save creds to the custom config GH_CONFIG_DIR=./.config gh auth login
Confirm this has saved to the new config GH_CONFIG_DIR=./.config gh auth status. Alternatively, you can run cat ./.config/hosts.yml
Hit the api: GH_CONFIG_DIR=./.config gh api /user | jq .login. This should show the same account you are logged in with
Now log in globally with a different account gh auth login
Hit the api again: GH_CONFIG_DIR=./.config api /user | jq .login. This will show the account you've logged into globally and not the one logged into with the specified config.

I'm not entirely sure what's going on, yet, but I am concerned that this might not be scoped only to gh api. Thanks for pointing this out! We'll discuss and get back to you.

@jtmcg

@jtmcg this is a bit of a funny scenario that has fallen between the Triage rotation cracks. I probably could have been clearer in #9111 (comment) but I'm pretty confident the issue at hand is a disconnect between the way the Active User is determined, and the Active Token is fetched.

I'll explain those now.

Active User

This is the user referenced by the user key under a particular host in the hosts.yml

Active Token

This is, in order:

The value of the token env vars
The value of the oauth_token key under a particular host in the hosts.yml (legacy, insecure)
The value in the keyring keyed by a particular host

So in this case, we're dealing with a changing hosts.yml containing the same host (github.com), but a keyring value that is keyed by a particular host.

So when the active token is fetched, it returns whatever token happened to be put in there last.

The reason auth switch resolves this is because auth switching was implemented by also keying tokens in the keyring by host and username, then swapping the token into the host keyed entry to make it active. This was for backwards compatibility reasons.

I have some thoughts on how we might resolve this but I'm on vacation and just wanted to drop this message so that you don't wild goose chase.

@jtmcg this is a bit of a funny scenario that has fallen between the Triage rotation cracks. I probably could have been clearer in #9111 (comment) but I'm pretty confident the issue at hand is a disconnect between the way the Active User is determined, and the Active Token is fetched.

I'll explain those now.

Active User

This is the user referenced by the user key under a particular host in the hosts.yml

Active Token

This is, in order:

The value of the token env vars
The value of the oauth_token key under a particular host in the hosts.yml (legacy, insecure)
The value in the keyring keyed by a particular host

So in this case, we're dealing with a changing hosts.yml containing the same host (github.com), but a keyring value that is keyed by a particular host. When the active token is fetched, it returns whatever token happened to be put in there last.

The reason auth switch resolves this is because auth switching was implemented by also keying tokens in the keyring by host and username, then swapping the token into the host keyed entry to make it active. This was for backwards compatibility reasons.

I have some thoughts on how we might resolve this but I'm on vacation and just wanted to drop this message so that you don't wild goose chase.

Ah, this is my bad. I totally missed the linked issue #9111 😅 This did, at least, give me a chance to explore this a bit and I can confirm the behavior! lol

I am hoping this issue will be resolved.
I want to switch the active account of gh for each directory.
For only my use case, I don't necessarily want to support the GH_CONFIG_DIR switch by direnv, since I only need to be able to specify the active account of gh per directory.

Acceptance Criteria

Given I have two accounts on a single github host
And Given I have each of these accounts as the active user in separate hosts.yml files
When I set GH_CONFIG_DIR to either of the files
And When I run gh api /user .login
Then I see the active user is correct as per the hosts.yml file

feat(identity): 계정 라우팅을 라벨이 아니라 실체로 검증 (L2 관측) (#188)

fix(identity): 게이트 오탐 2건 — 대소문자 비교 · probe 가 주변 환경을 보던 문제 (#189)

Navigation Menu

Repository navigation

Account incorrectly reported active in `gh auth status` #10136

Describe the bug

Steps to reproduce the behavior

Context

Repro steps

Active User

Active Token

Active User

Active Token

Acceptance Criteria

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	// ActiveToken will retrieve the active auth token for the given hostname,
	// searching environment variables, plain text config, and
	// lastly encrypted storage.
	func (c *AuthConfig) ActiveToken(hostname string) (string, string) {
	if c.tokenOverride != nil {
	return c.tokenOverride(hostname)
	}
	token, source := ghauth.TokenFromEnvOrConfig(hostname)
	if token == "" {
	var err error
	token, err = c.TokenFromKeyring(hostname)
	if err == nil {
	source = "keyring"
	}
	}
	return token, source
	}

Account incorrectly reported active in gh auth status #10136

Description

Describe the bug

Steps to reproduce the behavior

Context

Activity

med8bra commented on Dec 23, 2024

jtmcg commented on Dec 26, 2024

Repro steps

williammartin commented on Dec 27, 2024

Active User

Active Token

williammartin commented on Dec 27, 2024

Active User

Active Token

jtmcg commented on Dec 27, 2024

kyoh86 commented on Apr 15, 2025

williammartin commented on Jun 17, 2025

Acceptance Criteria

Shadow-web-pixel commented on Nov 10, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Account incorrectly reported active in `gh auth status` #10136