diff --git a/docs/reference.md b/docs/reference.md
index 4485c9149..dab7d12a9 100644
--- a/docs/reference.md
+++ b/docs/reference.md
@@ -149,7 +149,8 @@ SUBCOMMANDS
                to '~/.apify/auth.json'.
   auth logout  Removes authentication by deleting your API token and
                account information from '~/.apify/auth.json'.
-  auth token   Prints the current API token for the Apify CLI.
+  auth token   Prints the API token the CLI authenticates with,
+               resolved from APIFY_TOKEN or the token from 'apify login'.
 ```
 
 ##### `apify auth login` / `apify login`
@@ -168,7 +169,8 @@ USAGE
 FLAGS
   -m, --method=<option>  Method of logging in to Apify.
                          <options: console|manual>
-  -t, --token=<value>    Apify API token.
+  -t, --token=<value>    Apify API token to log in with and
+                         save to your OS keyring.
 ```
 
 ##### `apify auth logout` / `apify logout`
@@ -187,7 +189,8 @@ USAGE
 
 ```sh
 DESCRIPTION
-  Prints the current API token for the Apify CLI.
+  Prints the API token the CLI authenticates with, resolved from APIFY_TOKEN or 
+  the token from 'apify login'.
 
 USAGE
   $ apify auth token
@@ -315,13 +318,14 @@ FLAGS
                                  dependencies.
       --skip-git-init            Skip initializing a git
                                  repository in the Actor directory.
-      --source=<option>          How the Actor source
-                                 code is set up. "apify" keeps everything on this
-                                 machine and uploads nothing, so you deploy it with
-                                 "apify push". With a Git provider, Apify creates a
-                                 private repository on your connected account from
-                                 the template, clones it into the Actor directory,
-                                 and creates an Actor that builds from it.
+      --source=<option>          Where the Actor source
+                                 code lives. With "apify", the code stays on your
+                                 machine and nothing is uploaded. You can still
+                                 deploy your Actor with "apify push". With a Git
+                                 provider, Apify creates a private repository from
+                                 the template on your connected account, clones the
+                                 repository into the Actor directory, and builds the
+                                 Actor from it.
                                  <options: apify|github|gitlab|bitbucket>
   -t, --template=<value>         Template for the
                                  Actor. If not provided, the command will prompt for
@@ -1801,7 +1805,7 @@ ARGUMENTS
 
 FLAGS
   -t, --token=<value>  Apify API token to embed in the config.
-                       Defaults to the token from 'apify login'.
+                       Defaults to APIFY_TOKEN, then the token from 'apify login'.
       --tools=<value>  Comma-separated tool IDs or Actor full names
                        to expose. Forwarded as a '?tools=' query parameter.
       --url=<value>    Apify MCP server URL.
diff --git a/skills/apify/SKILL.md b/skills/apify/SKILL.md
index 4634b988a..ffe0688ab 100644
--- a/skills/apify/SKILL.md
+++ b/skills/apify/SKILL.md
@@ -22,9 +22,11 @@ If a command's help shows an "interactive note", it lists exactly which flags ma
 
 See https://apify.com/auth.md for how to authenticate. Do not assume `APIFY_TOKEN` is already set in the environment and use it implicitly — confirm with the user first.
 
-- Persist a session explicitly: `apify login --token <token>`.
-- Verify auth: `apify info` (prints the logged-in user; non-zero exit / error if not authenticated).
-- Print the stored token: `apify auth token`.
+`APIFY_TOKEN` wins over a stored login, for every command. When it is set, `apify login` refuses to run unless `--token` passes the same token — unset `APIFY_TOKEN` first, or skip the login.
+
+- Persist a session explicitly: `apify login --token <token>`. Exits non-zero on a rejected token, so `apify login --token <t> && apify push` is safe to chain.
+- Verify auth: `apify info` (prints the username, user ID, and which source the token came from; non-zero exit / error if not authenticated).
+- Print the token in use: `apify auth token` (the `APIFY_TOKEN` one when set, otherwise the stored login's).
 
 ## Structured output
 
diff --git a/src/commands/actor/charge.ts b/src/commands/actor/charge.ts
index dc2bd9ebb..49f7ada03 100644
--- a/src/commands/actor/charge.ts
+++ b/src/commands/actor/charge.ts
@@ -1,11 +1,10 @@
 import { APIFY_ENV_VARS } from '@apify/consts';
 
-import { getApifyTokenFromEnvOrAuthFile } from '../../lib/actor.js';
 import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { Args } from '../../lib/command-framework/args.js';
 import { Flags } from '../../lib/command-framework/flags.js';
 import { info } from '../../lib/outputs.js';
-import { getLoggedClient } from '../../lib/utils.js';
+import { getLoggedClientOrThrow } from '../../lib/utils.js';
 
 /**
  * This command can be used to charge for a specific event in the pay-per-event Actor run.
@@ -86,11 +85,7 @@ export class ActorChargeCommand extends ApifyCommand<typeof ActorChargeCommand>
 			return;
 		}
 
-		const apifyToken = await getApifyTokenFromEnvOrAuthFile();
-		const apifyClient = await getLoggedClient(apifyToken);
-		if (!apifyClient) {
-			throw new Error('Apify token is not set. Please set it using the environment variable APIFY_TOKEN.');
-		}
+		const apifyClient = await getLoggedClientOrThrow();
 		const runId = process.env[APIFY_ENV_VARS.ACTOR_RUN_ID];
 
 		if (!runId) {
diff --git a/src/commands/actors/call.ts b/src/commands/actors/call.ts
index e5f31e25d..01363f7ba 100644
--- a/src/commands/actors/call.ts
+++ b/src/commands/actors/call.ts
@@ -20,7 +20,7 @@ import { runActorOrTaskOnCloud, SharedRunOnCloudFlags } from '../../lib/commands
 import { finalizeRun, runUrl } from '../../lib/commands/run-result.js';
 import { CommandExitCodes, LOCAL_CONFIG_PATH } from '../../lib/consts.js';
 import { error, simpleLog } from '../../lib/outputs.js';
-import { getLocalConfig, getLocalUserInfo, getLoggedClientOrThrow, TimestampFormatter } from '../../lib/utils.js';
+import { getLocalConfig, getCurrentUserInfo, getLoggedClientOrThrow, TimestampFormatter } from '../../lib/utils.js';
 
 export class ActorsCallCommand extends ApifyCommand<typeof ActorsCallCommand> {
 	static override name = 'call' as const;
@@ -102,7 +102,7 @@ export class ActorsCallCommand extends ApifyCommand<typeof ActorsCallCommand> {
 		const cwd = process.cwd();
 		const localConfig = getLocalConfig(cwd) || {};
 		const apifyClient = await getLoggedClientOrThrow();
-		const userInfo = await getLocalUserInfo();
+		const userInfo = await getCurrentUserInfo();
 		const usernameOrId = userInfo.username || (userInfo.id as string);
 
 		if (this.flags.json && this.flags.outputDataset) {
diff --git a/src/commands/actors/pull.ts b/src/commands/actors/pull.ts
index 3d5d34027..feb526e60 100644
--- a/src/commands/actors/pull.ts
+++ b/src/commands/actors/pull.ts
@@ -12,7 +12,7 @@ import { Flags } from '../../lib/command-framework/flags.js';
 import { CommandExitCodes, LOCAL_CONFIG_PATH } from '../../lib/consts.js';
 import { useActorConfig } from '../../lib/hooks/useActorConfig.js';
 import { error, success } from '../../lib/outputs.js';
-import { downloadZip, getLocalUserInfo, getLoggedClientOrThrow } from '../../lib/utils.js';
+import { downloadZip, getCurrentUserInfo, getLoggedClientOrThrow } from '../../lib/utils.js';
 
 const extractGitHubZip = async (url: string, directoryPath: string) => {
 	const zipFile = await downloadZip(url);
@@ -80,8 +80,8 @@ export class ActorsPullCommand extends ApifyCommand<typeof ActorsPullCommand> {
 
 		const { config: actorConfig } = actorConfigResult.unwrap();
 
-		const userInfo = await getLocalUserInfo();
 		const apifyClient = await getLoggedClientOrThrow();
+		const userInfo = await getCurrentUserInfo();
 
 		const isActorAutomaticallyDetected = !this.args.actorId;
 		const usernameOrId = userInfo.username || userInfo.id;
diff --git a/src/commands/actors/push.ts b/src/commands/actors/push.ts
index 76fdb202c..64cca1880 100644
--- a/src/commands/actors/push.ts
+++ b/src/commands/actors/push.ts
@@ -29,7 +29,7 @@ import {
 	createActZip,
 	createSourceFiles,
 	getActorLocalFilePaths,
-	getLocalUserInfo,
+	getCurrentUserInfo,
 	getLoggedClientOrThrow,
 	outputJobLog,
 	parseWaitForFinishMillis,
@@ -286,7 +286,7 @@ export class ActorsPushCommand extends ApifyCommand<typeof ActorsPushCommand> {
 
 		const { config: actorConfig } = actorConfigResult.unwrap();
 
-		const userInfo = await getLocalUserInfo();
+		const userInfo = await getCurrentUserInfo();
 		const isOrganizationLoggedIn = !!userInfo.organizationOwnerUserId;
 		const redirectUrlPart = isOrganizationLoggedIn ? `/organization/${userInfo.id}` : '';
 
diff --git a/src/commands/actors/search.ts b/src/commands/actors/search.ts
index 49712a95e..dd1978c6f 100644
--- a/src/commands/actors/search.ts
+++ b/src/commands/actors/search.ts
@@ -1,13 +1,14 @@
 import { ApifyClient } from 'apify-client';
 import chalk from 'chalk';
 
+import { getAnonymousApifyClientOptions } from '../../lib/auth.js';
 import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { Args } from '../../lib/command-framework/args.js';
 import { Flags } from '../../lib/command-framework/flags.js';
 import { CompactMode, ResponsiveTable } from '../../lib/commands/responsive-table.js';
 import { CommandExitCodes } from '../../lib/consts.js';
 import { error, info, simpleLog } from '../../lib/outputs.js';
-import { getApifyClientOptions, printJsonToStdout } from '../../lib/utils.js';
+import { printJsonToStdout } from '../../lib/utils.js';
 
 const pricingModelLabels: Record<string, string> = {
 	FREE: 'Free',
@@ -96,9 +97,7 @@ export class ActorsSearchCommand extends ApifyCommand<typeof ActorsSearchCommand
 		const { query } = this.args;
 		const { json, sortBy, category, username, pricingModel, limit, offset } = this.flags;
 
-		const clientOptions = await getApifyClientOptions();
-		delete clientOptions.token;
-		const client = new ApifyClient(clientOptions);
+		const client = new ApifyClient(getAnonymousApifyClientOptions());
 
 		let result;
 
diff --git a/src/commands/actors/start.ts b/src/commands/actors/start.ts
index 164d04c6e..3ff5cb45e 100644
--- a/src/commands/actors/start.ts
+++ b/src/commands/actors/start.ts
@@ -12,7 +12,7 @@ import { runActorOrTaskOnCloud, SharedRunOnCloudFlags } from '../../lib/commands
 import { getConsoleUrl } from '../../lib/console-url.js';
 import { LOCAL_CONFIG_PATH } from '../../lib/consts.js';
 import { simpleLog } from '../../lib/outputs.js';
-import { getLocalConfig, getLocalUserInfo, getLoggedClientOrThrow, printJsonToStdout } from '../../lib/utils.js';
+import { getLocalConfig, getCurrentUserInfo, getLoggedClientOrThrow, printJsonToStdout } from '../../lib/utils.js';
 import { ActorsCallCommand } from './call.js';
 
 export class ActorsStartCommand extends ApifyCommand<typeof ActorsStartCommand> {
@@ -73,7 +73,7 @@ export class ActorsStartCommand extends ApifyCommand<typeof ActorsStartCommand>
 		const cwd = process.cwd();
 		const localConfig = getLocalConfig(cwd) || {};
 		const apifyClient = await getLoggedClientOrThrow();
-		const userInfo = await getLocalUserInfo();
+		const userInfo = await getCurrentUserInfo();
 		const usernameOrId = userInfo.username || (userInfo.id as string);
 
 		const {
diff --git a/src/commands/auth/login.ts b/src/commands/auth/login.ts
index d1799d1c6..959c99c2c 100644
--- a/src/commands/auth/login.ts
+++ b/src/commands/auth/login.ts
@@ -5,19 +5,21 @@ import chalk from 'chalk';
 import computerName from 'computer-name';
 import open from 'open';
 
+import { APIFY_ENV_VARS } from '@apify/consts';
 import { cryptoRandomObjectId } from '@apify/utilities';
 
+import { invalidEnvTokenMessage, loginWithToken, readEnvToken } from '../../lib/auth.js';
 import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { Flags } from '../../lib/command-framework/flags.js';
 import { getConsoleIntegrationsUrl, getConsoleUrl } from '../../lib/console-url.js';
-import { AUTH_FILE_PATH } from '../../lib/consts.js';
+import { AUTH_FILE_PATH, CommandExitCodes } from '../../lib/consts.js';
 import { getBackend } from '../../lib/credentials.js';
 import { updateUserId } from '../../lib/hooks/telemetry/useTelemetryState.js';
 import { useMaskedInput } from '../../lib/hooks/user-confirmations/useMaskedInput.js';
 import { useSelectFromList } from '../../lib/hooks/user-confirmations/useSelectFromList.js';
 import { createLocalApiServer } from '../../lib/local-api-server.js';
-import { error, info, success } from '../../lib/outputs.js';
-import { getLocalUserInfo, getLoggedClient, tildify } from '../../lib/utils.js';
+import { error, info, success, warning } from '../../lib/outputs.js';
+import { tildify } from '../../lib/utils.js';
 
 // When logging in against a local Console instance (local platform development), validate the token
 // against the local API rather than production.
@@ -28,10 +30,10 @@ const API_VERSION = 'v1';
 
 const tryToLogin = async (token: string) => {
 	const apiBaseUrl = getConsoleUrl().includes('localhost') ? LOCAL_API_BASE_URL : undefined;
-	const isUserLogged = await getLoggedClient(token, apiBaseUrl);
-	const userInfo = await getLocalUserInfo();
+	const result = await loginWithToken(token, apiBaseUrl);
 
-	if (isUserLogged) {
+	if (result) {
+		const { userInfo } = result;
 		await updateUserId(userInfo.id!);
 
 		const backend = await getBackend();
@@ -47,11 +49,12 @@ const tryToLogin = async (token: string) => {
 			message: `You are logged in to Apify as ${userInfo.username || userInfo.id}. ${chalk.gray(`Your token is stored in ${tokenLocation}.`)}`,
 		});
 	} else {
+		process.exitCode = CommandExitCodes.MissingAuth;
 		error({
 			message: 'Login to Apify failed, the provided API token is not valid.',
 		});
 	}
-	return isUserLogged;
+	return result;
 };
 
 export class AuthLoginCommand extends ApifyCommand<typeof AuthLoginCommand> {
@@ -85,7 +88,7 @@ export class AuthLoginCommand extends ApifyCommand<typeof AuthLoginCommand> {
 	static override flags = {
 		token: Flags.string({
 			char: 't',
-			description: 'Apify API token.',
+			description: 'Apify API token to log in with and save to your OS keyring.',
 			required: false,
 		}),
 		method: Flags.string({
@@ -99,6 +102,19 @@ export class AuthLoginCommand extends ApifyCommand<typeof AuthLoginCommand> {
 	async run() {
 		const { token, method } = this.flags;
 
+		const envToken = readEnvToken();
+		if (envToken.kind === 'invalid') {
+			warning({ message: invalidEnvTokenMessage(envToken.raw) });
+		}
+
+		if (envToken.kind === 'token' && envToken.token !== token?.trim()) {
+			error({
+				message: `${APIFY_ENV_VARS.TOKEN} is set, so other commands will ignore this login. Unset ${APIFY_ENV_VARS.TOKEN} and try again.`,
+			});
+			process.exitCode = CommandExitCodes.InvalidInput;
+			return;
+		}
+
 		if (token) {
 			await tryToLogin(token);
 			return;
diff --git a/src/commands/auth/logout.ts b/src/commands/auth/logout.ts
index fbf73807d..3ece55890 100644
--- a/src/commands/auth/logout.ts
+++ b/src/commands/auth/logout.ts
@@ -1,9 +1,12 @@
+import { APIFY_ENV_VARS } from '@apify/consts';
+
+import { invalidEnvTokenMessage, readEnvToken } from '../../lib/auth.js';
 import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { AUTH_FILE_PATH } from '../../lib/consts.js';
 import { clearKeyringSecrets } from '../../lib/credentials.js';
 import { rimrafPromised } from '../../lib/files.js';
 import { updateUserId } from '../../lib/hooks/telemetry/useTelemetryState.js';
-import { success } from '../../lib/outputs.js';
+import { success, warning } from '../../lib/outputs.js';
 import { tildify } from '../../lib/utils.js';
 
 export class AuthLogoutCommand extends ApifyCommand<typeof AuthLogoutCommand> {
@@ -31,5 +34,14 @@ export class AuthLogoutCommand extends ApifyCommand<typeof AuthLogoutCommand> {
 		await updateUserId(null);
 
 		success({ message: 'You are logged out from your Apify account.' });
+
+		const envToken = readEnvToken();
+		if (envToken.kind === 'token') {
+			warning({
+				message: `${APIFY_ENV_VARS.TOKEN} is still set, so commands stay authenticated with that token.`,
+			});
+		} else if (envToken.kind === 'invalid') {
+			warning({ message: invalidEnvTokenMessage(envToken.raw) });
+		}
 	}
 }
diff --git a/src/commands/auth/token.ts b/src/commands/auth/token.ts
index c2a307e88..3ddb644fd 100644
--- a/src/commands/auth/token.ts
+++ b/src/commands/auth/token.ts
@@ -1,15 +1,16 @@
+import { resolveAuth } from '../../lib/auth.js';
 import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { simpleLog } from '../../lib/outputs.js';
-import { getLocalUserInfo, getLoggedClientOrThrow } from '../../lib/utils.js';
+import { getLoggedClientOrThrow } from '../../lib/utils.js';
 
 export class AuthTokenCommand extends ApifyCommand<typeof AuthTokenCommand> {
 	static override name = 'token' as const;
 
-	static override description = 'Prints the current API token for the Apify CLI.';
+	static override description = `Prints the API token the CLI authenticates with, resolved from APIFY_TOKEN or the token from 'apify login'.`;
 
 	static override examples = [
 		{
-			description: 'Print the stored API token to stdout (use with care — it is a secret).',
+			description: `Print the resolved API token to stdout. Be careful with the output, it's a secret.`,
 			command: 'apify auth token',
 		},
 	];
@@ -18,10 +19,8 @@ export class AuthTokenCommand extends ApifyCommand<typeof AuthTokenCommand> {
 
 	async run() {
 		await getLoggedClientOrThrow();
-		const userInfo = await getLocalUserInfo();
+		const auth = await resolveAuth();
 
-		if (userInfo.token) {
-			simpleLog({ message: userInfo.token, stdout: true });
-		}
+		simpleLog({ message: auth!.token, stdout: true });
 	}
 }
diff --git a/src/commands/create.ts b/src/commands/create.ts
index 4d695d6cb..f0b6ae75e 100644
--- a/src/commands/create.ts
+++ b/src/commands/create.ts
@@ -50,7 +50,7 @@ import { LANGUAGE_FLAG_CHOICES, USE_CASE_FLAG_CHOICES } from '../lib/templates/c
 import {
 	downloadAndUnzip,
 	getJsonFileContent,
-	getLocalUserInfo,
+	getCurrentUserInfo,
 	getLoggedClientOrThrow,
 	isNodeVersionSupported,
 	isPythonVersionSupported,
@@ -318,8 +318,7 @@ export class CreateCommand extends ApifyCommand<typeof CreateCommand> {
 			? {
 					provider: gitProvider,
 					client: await getLoggedClientOrThrow(),
-					// Read after the client, which refreshes auth.json from the token the run resolved.
-					account: toGitAccount(await getLocalUserInfo()),
+					account: toGitAccount(await getCurrentUserInfo()),
 					// Omitted means on: the webhook is what makes a Git-sourced Actor rebuild on a push.
 					autoBuild: this.flags.autoBuild !== 'off',
 					...parseGitRepoFlag(gitRepo, actorName),
diff --git a/src/commands/datasets/get-items.ts b/src/commands/datasets/get-items.ts
index 93bf6847f..d06cf9555 100644
--- a/src/commands/datasets/get-items.ts
+++ b/src/commands/datasets/get-items.ts
@@ -4,7 +4,7 @@ import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { Args } from '../../lib/command-framework/args.js';
 import { Flags } from '../../lib/command-framework/flags.js';
 import { error, simpleLog } from '../../lib/outputs.js';
-import { getLocalUserInfo, getLoggedClientOrThrow } from '../../lib/utils.js';
+import { getCurrentUserInfo, getLoggedClientOrThrow } from '../../lib/utils.js';
 
 const downloadFormatToContentType: Record<DownloadItemsFormat, string> = {
 	[DownloadItemsFormat.JSON]: 'application/json',
@@ -106,7 +106,7 @@ export class DatasetsGetItems extends ApifyCommand<typeof DatasetsGetItems> {
 			};
 		}
 
-		const info = await getLocalUserInfo();
+		const info = await getCurrentUserInfo();
 
 		const byName = await client
 			.dataset(`${info.username!}/${datasetId}`)
diff --git a/src/commands/datasets/ls.ts b/src/commands/datasets/ls.ts
index 2a6102b39..793647a0a 100644
--- a/src/commands/datasets/ls.ts
+++ b/src/commands/datasets/ls.ts
@@ -5,7 +5,7 @@ import { Flags } from '../../lib/command-framework/flags.js';
 import { prettyPrintBytes } from '../../lib/commands/pretty-print-bytes.js';
 import { CompactMode, ResponsiveTable } from '../../lib/commands/responsive-table.js';
 import { info, simpleLog } from '../../lib/outputs.js';
-import { getLocalUserInfo, getLoggedClientOrThrow, printJsonToStdout, TimestampFormatter } from '../../lib/utils.js';
+import { getCurrentUserInfo, getLoggedClientOrThrow, printJsonToStdout, TimestampFormatter } from '../../lib/utils.js';
 
 const table = new ResponsiveTable({
 	allColumns: ['Dataset ID', 'Name', 'Items', 'Size', 'Created', 'Modified'],
@@ -58,7 +58,7 @@ export class DatasetsLsCommand extends ApifyCommand<typeof DatasetsLsCommand> {
 		const { desc, offset, limit, json, unnamed } = this.flags;
 
 		const client = await getLoggedClientOrThrow();
-		const user = await getLocalUserInfo();
+		const user = await getCurrentUserInfo();
 
 		const rawDatasetList = await client.datasets().list({ desc, offset, limit, unnamed });
 
diff --git a/src/commands/info.ts b/src/commands/info.ts
index 63c78402d..df10969e3 100644
--- a/src/commands/info.ts
+++ b/src/commands/info.ts
@@ -1,7 +1,8 @@
 import chalk from 'chalk';
 
+import { resolveAuth, TOKEN_SOURCE_LABELS } from '../lib/auth.js';
 import { ApifyCommand } from '../lib/command-framework/apify-command.js';
-import { getLocalUserInfo, getLoggedClientOrThrow } from '../lib/utils.js';
+import { getCurrentUserInfo, getLoggedClientOrThrow } from '../lib/utils.js';
 
 export class InfoCommand extends ApifyCommand<typeof InfoCommand> {
 	static override name = 'info' as const;
@@ -21,17 +22,17 @@ export class InfoCommand extends ApifyCommand<typeof InfoCommand> {
 
 	async run() {
 		await getLoggedClientOrThrow();
-		const info = await getLocalUserInfo();
+		const info = await getCurrentUserInfo();
+		const auth = await resolveAuth();
 
-		if (info) {
-			const niceInfo = {
-				username: info.username,
-				userId: info.id,
-			} as const;
+		const rows = {
+			'username': info.username,
+			'userId': info.id,
+			'token source': TOKEN_SOURCE_LABELS[auth!.source],
+		};
 
-			for (const key of Object.keys(niceInfo) as (keyof typeof niceInfo)[]) {
-				console.log(`${chalk.gray(key)}: ${chalk.bold(niceInfo[key])}`);
-			}
+		for (const [key, value] of Object.entries(rows)) {
+			console.log(`${chalk.gray(key)}: ${chalk.bold(value)}`);
 		}
 	}
 }
diff --git a/src/commands/key-value-stores/ls.ts b/src/commands/key-value-stores/ls.ts
index 880d595af..e516df91d 100644
--- a/src/commands/key-value-stores/ls.ts
+++ b/src/commands/key-value-stores/ls.ts
@@ -5,7 +5,7 @@ import { Flags } from '../../lib/command-framework/flags.js';
 import { prettyPrintBytes } from '../../lib/commands/pretty-print-bytes.js';
 import { CompactMode, ResponsiveTable } from '../../lib/commands/responsive-table.js';
 import { info, simpleLog } from '../../lib/outputs.js';
-import { getLocalUserInfo, getLoggedClientOrThrow, printJsonToStdout, TimestampFormatter } from '../../lib/utils.js';
+import { getCurrentUserInfo, getLoggedClientOrThrow, printJsonToStdout, TimestampFormatter } from '../../lib/utils.js';
 
 const table = new ResponsiveTable({
 	allColumns: ['Store ID', 'Name', 'Size', 'Created', 'Modified'],
@@ -55,7 +55,7 @@ export class KeyValueStoresLsCommand extends ApifyCommand<typeof KeyValueStoresL
 		const { desc, offset, limit, json, unnamed } = this.flags;
 
 		const client = await getLoggedClientOrThrow();
-		const user = await getLocalUserInfo();
+		const user = await getCurrentUserInfo();
 
 		const rawKvsList = await client.keyValueStores().list({ desc, offset, limit, unnamed });
 
diff --git a/src/commands/mcp/install.ts b/src/commands/mcp/install.ts
index f75c65b39..e6b4aa4a3 100644
--- a/src/commands/mcp/install.ts
+++ b/src/commands/mcp/install.ts
@@ -1,5 +1,6 @@
 import process from 'node:process';
 
+import { resolveAuth } from '../../lib/auth.js';
 import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { Args } from '../../lib/command-framework/args.js';
 import { Flags, YesFlag } from '../../lib/command-framework/flags.js';
@@ -7,25 +8,6 @@ import { CommandExitCodes } from '../../lib/consts.js';
 import { clientNeedsToken, getClientHandler, isSupportedClient, SUPPORTED_CLIENTS } from '../../lib/mcp/clients.js';
 import { buildMcpUrl, DEFAULT_MCP_URL } from '../../lib/mcp/url.js';
 import { error } from '../../lib/outputs.js';
-import { getLocalUserInfo } from '../../lib/utils.js';
-
-/**
- * Resolution order: --token flag → APIFY_TOKEN env → stored login.
- * Prints a user-facing error and sets process.exitCode when no token is available.
- */
-async function resolveApifyToken(tokenFlag: string | undefined): Promise<string | null> {
-	if (tokenFlag) return tokenFlag;
-	if (process.env.APIFY_TOKEN) return process.env.APIFY_TOKEN;
-
-	const userInfo = await getLocalUserInfo();
-	if (userInfo.token) return userInfo.token;
-
-	error({
-		message: `You are not logged in to Apify. Run 'apify login' first, or pass --token <api-token>.`,
-	});
-	process.exitCode = CommandExitCodes.MissingAuth;
-	return null;
-}
 
 export class MCPInstallCommand extends ApifyCommand<typeof MCPInstallCommand> {
 	static override name = 'install' as const;
@@ -71,7 +53,7 @@ export class MCPInstallCommand extends ApifyCommand<typeof MCPInstallCommand> {
 		...YesFlag(`Overwrite an existing 'apify' entry without prompting.`),
 		token: Flags.string({
 			char: 't',
-			description: `Apify API token to embed in the config. Defaults to the token from 'apify login'.`,
+			description: `Apify API token to embed in the config. Defaults to APIFY_TOKEN, then the token from 'apify login'.`,
 		}),
 		url: Flags.string({
 			description: 'Apify MCP server URL.',
@@ -96,9 +78,15 @@ export class MCPInstallCommand extends ApifyCommand<typeof MCPInstallCommand> {
 
 		let token = '';
 		if (clientNeedsToken(client)) {
-			const resolved = await resolveApifyToken(tokenFlag);
-			if (!resolved) return;
-			token = resolved;
+			const auth = tokenFlag ? { token: tokenFlag } : await resolveAuth();
+			if (!auth) {
+				error({
+					message: `You are not logged in to Apify. Run 'apify login' first, or pass --token <api-token>.`,
+				});
+				process.exitCode = CommandExitCodes.MissingAuth;
+				return;
+			}
+			token = auth.token;
 		}
 
 		await getClientHandler(client)({ url: buildMcpUrl(baseUrl, tools), token, yes });
diff --git a/src/commands/run.ts b/src/commands/run.ts
index f85b04f7e..a943d10da 100644
--- a/src/commands/run.ts
+++ b/src/commands/run.ts
@@ -10,6 +10,7 @@ import { minVersion } from 'semver';
 import { ACTOR_ENV_VARS, APIFY_ENV_VARS } from '@apify/consts';
 import { validateInputSchema, validateInputUsingValidator } from '@apify/input_schema';
 
+import { resolveAuth } from '../lib/auth.js';
 import { ApifyCommand, StdinMode } from '../lib/command-framework/apify-command.js';
 import { Flags } from '../lib/command-framework/flags.js';
 import { getInputOverride } from '../lib/commands/resolve-input.js';
@@ -30,13 +31,14 @@ import { getAjvValidator, getDefaultsFromInputSchema, readInputSchema } from '..
 import { deleteKvsRecord, writeKvsRecord } from '../lib/kvs-metadata.js';
 import { error, info, warning } from '../lib/outputs.js';
 import { replaceSecretsValue } from '../lib/secrets.js';
+import type { AuthJSON } from '../lib/types.js';
 import {
 	Ajv2019,
 	checkIfStorageIsEmpty,
 	getLocalInput,
 	getLocalKeyValueStorePath,
 	getLocalStorageDir,
-	getLocalUserInfo,
+	getCurrentUserInfo,
 	isNodeVersionSupported,
 	isPythonVersionSupported,
 	type LocalInput,
@@ -44,6 +46,7 @@ import {
 	purgeDefaultKeyValueStore,
 	purgeDefaultQueue,
 } from '../lib/utils.js';
+import { cliDebugPrint } from '../lib/utils/cliDebugPrint.js';
 
 interface TempInputResult {
 	tempInputKey: string;
@@ -160,7 +163,12 @@ export class RunCommand extends ApifyCommand<typeof RunCommand> {
 	async run() {
 		const cwd = process.cwd();
 
-		const { proxy, id: userId, token } = await getLocalUserInfo();
+		const auth = await resolveAuth();
+		// This only fills in two env vars for the child, so a failed lookup must not stop the run.
+		const { proxy, id: userId } = await getCurrentUserInfo().catch((err): AuthJSON => {
+			cliDebugPrint('[run] could not resolve the account behind the token', { error: err });
+			return {};
+		});
 
 		const localConfigResult = await useActorConfig({ cwd });
 
@@ -346,7 +354,7 @@ export class RunCommand extends ApifyCommand<typeof RunCommand> {
 
 		if (proxy && proxy.password) localEnvVars[APIFY_ENV_VARS.PROXY_PASSWORD] = proxy.password;
 		if (userId) localEnvVars[APIFY_ENV_VARS.USER_ID] = userId;
-		if (token) localEnvVars[APIFY_ENV_VARS.TOKEN] = token;
+		if (auth) localEnvVars[APIFY_ENV_VARS.TOKEN] = auth.token;
 		if (localConfig!.environmentVariables) {
 			const updatedEnv = replaceSecretsValue(localConfig!.environmentVariables as Record<string, string>, undefined, {
 				allowMissing: this.flags.allowMissingSecrets,
@@ -357,7 +365,7 @@ export class RunCommand extends ApifyCommand<typeof RunCommand> {
 		// localEnvVars must take priority so the CLI can redirect the SDK to temp input files
 		const env = { ...process.env, ...localEnvVars };
 
-		if (!userId) {
+		if (!auth) {
 			warning({
 				message:
 					'You are not logged in with your Apify Account. Some features like Apify Proxy will not work. Call "apify login" to fix that.',
diff --git a/src/commands/task/publish.ts b/src/commands/task/publish.ts
index bd43ea488..297f49fa3 100644
--- a/src/commands/task/publish.ts
+++ b/src/commands/task/publish.ts
@@ -7,7 +7,7 @@ import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { Args } from '../../lib/command-framework/args.js';
 import { CommandExitCodes } from '../../lib/consts.js';
 import { error, success } from '../../lib/outputs.js';
-import { getLocalUserInfo, getLoggedClientOrThrow } from '../../lib/utils.js';
+import { getCurrentUserInfo, getLoggedClientOrThrow } from '../../lib/utils.js';
 
 export class TaskPublishCommand extends ApifyCommand<typeof TaskPublishCommand> {
 	static override name = 'publish' as const;
@@ -40,7 +40,7 @@ export class TaskPublishCommand extends ApifyCommand<typeof TaskPublishCommand>
 
 	async run() {
 		const apifyClient = await getLoggedClientOrThrow();
-		const userInfo = await getLocalUserInfo();
+		const userInfo = await getCurrentUserInfo();
 		const usernameOrId = userInfo.username || (userInfo.id as string);
 
 		const { taskId } = this.args;
diff --git a/src/commands/task/run.ts b/src/commands/task/run.ts
index e4e9add60..1e6d2055f 100644
--- a/src/commands/task/run.ts
+++ b/src/commands/task/run.ts
@@ -4,7 +4,7 @@ import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { Args } from '../../lib/command-framework/args.js';
 import { runActorOrTaskOnCloud, SharedRunOnCloudFlags } from '../../lib/commands/run-on-cloud.js';
 import { finalizeRun } from '../../lib/commands/run-result.js';
-import { getLocalUserInfo, getLoggedClientOrThrow } from '../../lib/utils.js';
+import { getCurrentUserInfo, getLoggedClientOrThrow } from '../../lib/utils.js';
 
 export class TaskRunCommand extends ApifyCommand<typeof TaskRunCommand> {
 	static override name = 'run' as const;
@@ -39,7 +39,7 @@ export class TaskRunCommand extends ApifyCommand<typeof TaskRunCommand> {
 
 	async run() {
 		const apifyClient = await getLoggedClientOrThrow();
-		const userInfo = await getLocalUserInfo();
+		const userInfo = await getCurrentUserInfo();
 		const usernameOrId = userInfo.username || (userInfo.id as string);
 
 		const { id: taskId, userFriendlyId, title } = await this.resolveTaskId(apifyClient, usernameOrId);
diff --git a/src/commands/task/unpublish.ts b/src/commands/task/unpublish.ts
index 26c2a310e..b272dc60c 100644
--- a/src/commands/task/unpublish.ts
+++ b/src/commands/task/unpublish.ts
@@ -7,7 +7,7 @@ import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { Args } from '../../lib/command-framework/args.js';
 import { CommandExitCodes } from '../../lib/consts.js';
 import { error, success } from '../../lib/outputs.js';
-import { getLocalUserInfo, getLoggedClientOrThrow } from '../../lib/utils.js';
+import { getCurrentUserInfo, getLoggedClientOrThrow } from '../../lib/utils.js';
 
 export class TaskUnpublishCommand extends ApifyCommand<typeof TaskUnpublishCommand> {
 	static override name = 'unpublish' as const;
@@ -39,7 +39,7 @@ export class TaskUnpublishCommand extends ApifyCommand<typeof TaskUnpublishComma
 
 	async run() {
 		const apifyClient = await getLoggedClientOrThrow();
-		const userInfo = await getLocalUserInfo();
+		const userInfo = await getCurrentUserInfo();
 		const usernameOrId = userInfo.username || (userInfo.id as string);
 
 		const { taskId } = this.args;
diff --git a/src/lib/actor.ts b/src/lib/actor.ts
index f0823c2c7..09dd31e07 100644
--- a/src/lib/actor.ts
+++ b/src/lib/actor.ts
@@ -9,7 +9,8 @@ import { ApifyClient } from 'apify-client';
 
 import { ACTOR_ENV_VARS, APIFY_ENV_VARS, KEY_VALUE_STORE_KEYS, LOCAL_ACTOR_ENV_VARS } from '@apify/consts';
 
-import { getApifyClientOptions, getLocalStorageDir, getLocalUserInfo } from './utils.js';
+import { describeAuthFailure, getApifyClientOptionsForToken, resolveAuth } from './auth.js';
+import { getLocalStorageDir } from './utils.js';
 
 export const APIFY_STORAGE_TYPES = {
 	KEY_VALUE_STORE: 'KEY_VALUE_STORE',
@@ -17,26 +18,6 @@ export const APIFY_STORAGE_TYPES = {
 	REQUEST_QUEUE: 'REQUEST_QUEUE',
 } as const;
 
-/**
- * Returns Apify token from environment variable or local auth file.
- * @returns Apify token
- */
-export const getApifyTokenFromEnvOrAuthFile = async () => {
-	const apifyToken = process.env[APIFY_ENV_VARS.TOKEN];
-	if (apifyToken) {
-		return apifyToken;
-	}
-
-	const localUserInfo = await getLocalUserInfo();
-	if (!localUserInfo || !localUserInfo.token) {
-		throw new Error(
-			'Apify token is not set. Please set it using the environment variable APIFY_TOKEN or apify login command.',
-		);
-	}
-
-	return localUserInfo.token;
-};
-
 /**
  * Returns instance of ApifyClient or ApifyStorageLocal based on environment variables.
  * @param options - ApifyClient options
@@ -54,10 +35,13 @@ export const getApifyStorageClient = async (
 			...options,
 		});
 	}
-	const apifyToken = await getApifyTokenFromEnvOrAuthFile();
+	const auth = await resolveAuth();
+	if (!auth) {
+		throw new Error(describeAuthFailure(auth));
+	}
 
 	return new ApifyClient({
-		...(await getApifyClientOptions(apifyToken)),
+		...getApifyClientOptionsForToken(auth.token),
 		...options,
 	});
 };
diff --git a/src/lib/auth.ts b/src/lib/auth.ts
new file mode 100644
index 000000000..b2793e193
--- /dev/null
+++ b/src/lib/auth.ts
@@ -0,0 +1,191 @@
+import { existsSync, writeFileSync } from 'node:fs';
+import process from 'node:process';
+
+import { ApifyApiError, ApifyClient, type ApifyClientOptions } from 'apify-client';
+import { AxiosHeaders } from 'axios';
+
+import { APIFY_ENV_VARS } from '@apify/consts';
+
+import { APIFY_CLIENT_DEFAULT_HEADERS, AUTH_FILE_PATH, CommandExitCodes } from './consts.js';
+import {
+	deleteProxyPassword,
+	ensureMigrated,
+	getBackend,
+	getToken,
+	setProxyPassword,
+	setToken,
+	stripProxyPassword,
+} from './credentials.js';
+import { ensureApifyDirectory } from './files.js';
+import { warning } from './outputs.js';
+import type { AuthJSON } from './types.js';
+import { cliDebugPrint } from './utils/cliDebugPrint.js';
+
+export type TokenSource = 'env' | 'stored';
+
+export interface ResolvedAuth {
+	token: string;
+	source: TokenSource;
+}
+
+/**
+ * Values that mean the variable was never really set: `APIFY_TOKEN=$UNSET_VAR` leaves an empty
+ * string, and templating an absent value writes the literal "undefined".
+ */
+const PLACEHOLDER_TOKENS = new Set(['undefined', 'null', 'nil', 'none', 'nan', 'false', '0', '-']);
+
+/**
+ * What `APIFY_TOKEN` holds. Blank and placeholder values are distinct: the first means nobody set
+ * it, the second means someone meant to and got it wrong. Collapsing them left `login` and
+ * `logout` unable to see a value that every other command rejects.
+ */
+export type EnvToken = { kind: 'unset' } | { kind: 'invalid'; raw: string } | { kind: 'token'; token: string };
+
+export function readEnvToken(): EnvToken {
+	const raw = process.env[APIFY_ENV_VARS.TOKEN]?.trim();
+	if (!raw) return { kind: 'unset' };
+	if (PLACEHOLDER_TOKENS.has(raw.toLowerCase())) return { kind: 'invalid', raw };
+	return { kind: 'token', token: raw };
+}
+
+/** One wording for an `APIFY_TOKEN` set to something unusable, whether it aborts or only warns. */
+export function invalidEnvTokenMessage(raw: string): string {
+	return `${APIFY_ENV_VARS.TOKEN} is set to "${raw}", which is not an API token. Unset ${APIFY_ENV_VARS.TOKEN} and try again.`;
+}
+
+/** Where a resolved token came from, for messages that need to name it. */
+export const TOKEN_SOURCE_LABELS: Record<TokenSource, string> = {
+	env: `${APIFY_ENV_VARS.TOKEN} environment variable`,
+	stored: 'apify login',
+};
+
+let authPromise: Promise<ResolvedAuth | undefined> | undefined;
+
+/** Test-only: drop the resolved token so each test resolves afresh. */
+export function __resetAuthForTests() {
+	authPromise = undefined;
+}
+
+/**
+ * The single token resolver. Order: `APIFY_TOKEN` -> stored login. Inside a platform run there is
+ * no stored login, so `APIFY_TOKEN` wins without a special case for the `actor` entrypoint.
+ *
+ * Single-flighted like {@link getBackend}, because several callers resolve per command and reading
+ * the stored token is an uncached OS keyring hit.
+ *
+ * Read-only by contract, apart from the one-shot migration of an existing plaintext auth.json.
+ * Only `apify login` writes credentials, through {@link loginWithToken}.
+ *
+ * Throws when `APIFY_TOKEN` holds a placeholder value.
+ */
+export const resolveAuth = async (): Promise<ResolvedAuth | undefined> => {
+	authPromise ??= (async () => {
+		await ensureMigrated();
+
+		const envToken = readEnvToken();
+		if (envToken.kind === 'invalid') {
+			process.exitCode = CommandExitCodes.InvalidInput;
+			throw new Error(invalidEnvTokenMessage(envToken.raw));
+		}
+
+		if (envToken.kind === 'token') {
+			if (existsSync(AUTH_FILE_PATH())) {
+				warning({ message: `Using the API token from ${APIFY_ENV_VARS.TOKEN}.` });
+			}
+
+			return { token: envToken.token, source: 'env' } as const;
+		}
+
+		const storedToken = await getToken();
+		return storedToken ? ({ token: storedToken, source: 'stored' } as const) : undefined;
+	})();
+
+	try {
+		return await authPromise;
+	} catch (err) {
+		// A rejected promise would otherwise be replayed to every later caller in this process.
+		authPromise = undefined;
+		throw err;
+	}
+};
+
+export function describeAuthFailure(auth: ResolvedAuth | undefined, error?: unknown): string {
+	if (!auth) {
+		return 'You are not logged in with your Apify account. Call "apify login" to fix that.';
+	}
+
+	// Only the API can reject a token, so a failure that carries no auth status is something else.
+	const statusCode = error instanceof ApifyApiError ? error.statusCode : undefined;
+	if (error && statusCode !== 401 && statusCode !== 403) {
+		const reason = error instanceof Error ? error.message : String(error);
+		return `Could not verify your API token. The Apify API request failed: ${reason}`;
+	}
+
+	switch (auth.source) {
+		case 'env':
+			return `The API token in ${APIFY_ENV_VARS.TOKEN} was rejected. Unset it to use your stored login instead.`;
+		default:
+			return 'Your stored API token was rejected. Call "apify login" to log in again.';
+	}
+}
+
+type CJSAxiosHeaders = import('axios', { with: { 'resolution-mode': 'require' } }).AxiosRequestConfig['headers'];
+
+/** Base URL and headers, with no token and so no credential lookup. */
+export const getAnonymousApifyClientOptions = (apiBaseUrl?: string): ApifyClientOptions => ({
+	baseUrl: apiBaseUrl || process.env.APIFY_CLIENT_BASE_URL,
+	requestInterceptors: [
+		(config) => {
+			config.headers ??= new AxiosHeaders() as CJSAxiosHeaders;
+
+			for (const [key, value] of Object.entries(APIFY_CLIENT_DEFAULT_HEADERS)) {
+				config.headers![key] = value;
+			}
+
+			return config;
+		},
+	],
+});
+
+/** Options for a caller that already holds a token, so nothing is resolved. */
+export const getApifyClientOptionsForToken = (token: string, apiBaseUrl?: string): ApifyClientOptions => ({
+	...getAnonymousApifyClientOptions(apiBaseUrl),
+	token,
+});
+
+/** The only credential writer in the CLI. Returns `null` when the token is rejected, writing nothing. */
+export async function loginWithToken(
+	token: string,
+	apiBaseUrl?: string,
+): Promise<{ client: ApifyClient; userInfo: AuthJSON } | null> {
+	const apifyClient = new ApifyClient(getApifyClientOptionsForToken(token, apiBaseUrl));
+
+	let userInfo;
+	try {
+		userInfo = await apifyClient.user('me').get();
+	} catch (err) {
+		cliDebugPrint('[loginWithToken] error getting user info', { error: err, apiBaseUrl });
+		return null;
+	}
+
+	const proxyPassword = userInfo.proxy?.password;
+
+	// Replaces the previous account rather than merging, so stale fields cannot linger. The spread
+	// is shallow, so stripping here also clears userInfo.proxy — read the password first.
+	const fileContents = { ...userInfo, secretsBackend: await getBackend() };
+	stripProxyPassword(fileContents);
+
+	ensureApifyDirectory(AUTH_FILE_PATH());
+	writeFileSync(AUTH_FILE_PATH(), JSON.stringify(fileContents, null, '\t'), { mode: 0o600 });
+
+	// After the metadata file, which would clobber them on the file backend. `skipIfUnchanged` avoids a Keychain prompt.
+	await setToken(token, { skipIfUnchanged: true });
+
+	if (proxyPassword) {
+		await setProxyPassword(proxyPassword, { skipIfUnchanged: true });
+	} else {
+		await deleteProxyPassword();
+	}
+
+	return { client: apifyClient, userInfo };
+}
diff --git a/src/lib/commands/resolve-actor-context.ts b/src/lib/commands/resolve-actor-context.ts
index 22d45e34a..bc0ed27c7 100644
--- a/src/lib/commands/resolve-actor-context.ts
+++ b/src/lib/commands/resolve-actor-context.ts
@@ -2,7 +2,7 @@ import process from 'node:process';
 
 import type { ApifyClient } from 'apify-client';
 
-import { getLocalConfig, getLocalUserInfo } from '../utils.js';
+import { getLocalConfig, getCurrentUserInfo } from '../utils.js';
 
 /**
  * Tries to resolve what actor the command ran points to. If an actor id is provided via command line, attempt to resolve it,
@@ -17,7 +17,7 @@ export async function resolveActorContext({
 	providedActorNameOrId: string | undefined;
 	client: ApifyClient;
 }) {
-	const userInfo = await getLocalUserInfo();
+	const userInfo = await getCurrentUserInfo();
 	const usernameOrId = userInfo.username || (userInfo.id as string);
 	const localConfig = getLocalConfig(process.cwd()) || {};
 
diff --git a/src/lib/commands/storages.ts b/src/lib/commands/storages.ts
index f3d043de3..1fbd6cdc7 100644
--- a/src/lib/commands/storages.ts
+++ b/src/lib/commands/storages.ts
@@ -1,6 +1,6 @@
 import type { ApifyClient, Dataset, DatasetClient, KeyValueStore, KeyValueStoreClient } from 'apify-client';
 
-import { getLocalUserInfo } from '../utils.js';
+import { getCurrentUserInfo } from '../utils.js';
 
 type ReturnTypeForStorage<T extends 'dataset' | 'keyValueStore'> = T extends 'dataset'
 	? {
@@ -25,7 +25,7 @@ async function tryToGetStorage<T extends 'dataset' | 'keyValueStore'>(
 		} as ReturnTypeForStorage<T>;
 	}
 
-	const info = await getLocalUserInfo();
+	const info = await getCurrentUserInfo();
 
 	const byName = await client[storageType](`${info.username!}/${id}`)
 		.get()
diff --git a/src/lib/credentials.ts b/src/lib/credentials.ts
index f4a8e2d1d..3758cd502 100644
--- a/src/lib/credentials.ts
+++ b/src/lib/credentials.ts
@@ -114,6 +114,17 @@ function readAuthFile(): StoredAuthFile {
 	}
 }
 
+/**
+ * Remove the proxy password, keeping any sibling field like `groups` and dropping `proxy`
+ * entirely when the secret was all it carried.
+ */
+export function stripProxyPassword(data: { proxy?: { password?: string } }) {
+	if (!data.proxy) return;
+
+	delete data.proxy.password;
+	if (Object.keys(data.proxy).length === 0) delete data.proxy;
+}
+
 function writeAuthFile(data: StoredAuthFile) {
 	ensureApifyDirectory(AUTH_FILE_PATH());
 	writeFileSync(AUTH_FILE_PATH(), JSON.stringify(data, null, '\t'), { mode: 0o600 });
@@ -216,6 +227,24 @@ export async function setProxyPassword(password: string, opts: { skipIfUnchanged
 	writeAuthFile(data);
 }
 
+/**
+ * Forget the stored proxy password. Called when an account has none, so the previous account's
+ * does not survive a re-login — the keyring outlives the auth.json rewrite that replaces
+ * everything else.
+ */
+export async function deleteProxyPassword(): Promise<void> {
+	if ((await getBackend()) === 'keyring') {
+		await deleteKeyring(PROXY_PASSWORD_ACCOUNT);
+		return;
+	}
+
+	const data = readAuthFile();
+	if (!data.proxy?.password) return;
+
+	stripProxyPassword(data);
+	writeAuthFile(data);
+}
+
 /**
  * Remove the token and proxy-password entries from the OS keyring. Always attempts the
  * keyring deletes even when the current backend is `file`, so toggling
@@ -265,12 +294,7 @@ export async function ensureMigrated(): Promise<void> {
 			}
 
 			delete file.token;
-			if (file.proxy) {
-				delete file.proxy.password;
-				// Drop the proxy object entirely when only the password lived there,
-				// but keep it (minus the secret) when it carries other fields like `groups`.
-				if (Object.keys(file.proxy).length === 0) delete file.proxy;
-			}
+			stripProxyPassword(file);
 			file.secretsBackend = 'keyring';
 			writeAuthFile(file);
 		} catch (err) {
diff --git a/src/lib/utils.ts b/src/lib/utils.ts
index 3e5f464aa..0bdfea073 100644
--- a/src/lib/utils.ts
+++ b/src/lib/utils.ts
@@ -9,9 +9,9 @@ import { DurationFormatter as SapphireDurationFormatter, TimeTypes } from '@sapp
 import { Timestamp } from '@sapphire/timestamp';
 import AdmZip from 'adm-zip';
 import _Ajv2019 from 'ajv/dist/2019.js';
-import { type ActorRun, ApifyClient, type ApifyClientOptions, type Build } from 'apify-client';
+import { type ActorRun, ApifyClient, type Build } from 'apify-client';
 import { ZipArchive } from 'archiver';
-import axios, { AxiosHeaders } from 'axios';
+import axios from 'axios';
 import escapeStringRegexp from 'escape-string-regexp';
 import ignoreModule, { type Ignore } from 'ignore';
 import { getEncoding } from 'istextorbinary';
@@ -32,8 +32,8 @@ import {
 	SOURCE_FILE_FORMATS,
 } from '@apify/consts';
 
+import { describeAuthFailure, getApifyClientOptionsForToken, resolveAuth, type ResolvedAuth } from './auth.js';
 import {
-	APIFY_CLIENT_DEFAULT_HEADERS,
 	AUTH_FILE_PATH,
 	CommandExitCodes,
 	DEFAULT_LOCAL_STORAGE_DIR,
@@ -41,8 +41,8 @@ import {
 	MINIMUM_SUPPORTED_PYTHON_VERSION,
 	SUPPORTED_NODEJS_VERSION,
 } from './consts.js';
-import { ensureMigrated, getBackend, getProxyPassword, getToken, setProxyPassword, setToken } from './credentials.js';
-import { deleteFile, ensureApifyDirectory, ensureFolderExistsSync, rimrafPromised } from './files.js';
+import { ensureMigrated, getBackend, getProxyPassword, getToken } from './credentials.js';
+import { deleteFile, ensureFolderExistsSync, rimrafPromised } from './files.js';
 import { useCLIMetadata } from './hooks/useCLIMetadata.js';
 import { inputFileRegExp, TEMP_INPUT_KEY_PREFIX } from './input-key.js';
 import { encodeRecordKey, readKvsRecordMetadata, recordMetadataFileName } from './kvs-metadata.js';
@@ -121,98 +121,65 @@ export const getLocalUserInfo = async (): Promise<AuthJSON> => {
  * Gets instance of ApifyClient for user otherwise throws error
  */
 export async function getLoggedClientOrThrow() {
-	const loggedClient = await getLoggedClient();
+	const { client, auth, error } = await getLoggedClient();
 
-	if (!loggedClient) {
+	if (!client) {
 		process.exitCode = CommandExitCodes.MissingAuth;
-		throw new Error('You are not logged in with your Apify account. Call "apify login" to fix that.');
+		throw new Error(describeAuthFailure(auth, error));
 	}
-	return loggedClient;
+	return client;
 }
 
-const resolveToken = async (existingToken?: string): Promise<string | undefined> => {
-	if (existingToken) return existingToken;
-	await ensureMigrated();
-	return getToken();
-};
-
-type CJSAxiosHeaders = import('axios', { with: { 'resolution-mode': 'require' } }).AxiosRequestConfig['headers'];
+let cachedUserInfo: { token: string; userInfo: AuthJSON } | undefined;
 
-/**
- * Returns options for ApifyClient
- */
-export const getApifyClientOptions = async (token?: string, apiBaseUrl?: string): Promise<ApifyClientOptions> => {
-	const resolvedToken = await resolveToken(token);
-
-	return {
-		token: resolvedToken,
-		baseUrl: apiBaseUrl || process.env.APIFY_CLIENT_BASE_URL,
-		requestInterceptors: [
-			(config) => {
-				config.headers ??= new AxiosHeaders() as CJSAxiosHeaders;
-
-				for (const [key, value] of Object.entries(APIFY_CLIENT_DEFAULT_HEADERS)) {
-					config.headers![key] = value;
-				}
-
-				return config;
-			},
-		],
-	};
-};
+/** Test-only: drop the in-memory account metadata so each test starts fresh. */
+export function __resetUserInfoCacheForTests() {
+	cachedUserInfo = undefined;
+}
 
 /**
- * Gets instance of ApifyClient for token or for params from global auth file.
+ * `client` is `null` when no token is available or the lookup failed; `error` carries that
+ * failure, so the caller can tell a rejected token from an API it could not reach.
  *
- * Refreshes the user metadata in auth.json each run. Secrets (token, proxy.password) only
- * get written when their value actually changes — avoids macOS Keychain prompts on every command.
+ * Read-only: the resolved token is never persisted.
  */
-export async function getLoggedClient(token?: string, apiBaseUrl?: string) {
-	const resolvedToken = await resolveToken(token);
+async function getLoggedClient(): Promise<{ client: ApifyClient | null; auth?: ResolvedAuth; error?: unknown }> {
+	const auth = await resolveAuth();
+	if (!auth) return { client: null };
 
-	const apifyClient = new ApifyClient(await getApifyClientOptions(resolvedToken, apiBaseUrl));
+	const apifyClient = new ApifyClient(getApifyClientOptionsForToken(auth.token));
 
-	let userInfo;
 	try {
-		userInfo = await apifyClient.user('me').get();
+		const userInfo = (await apifyClient.user('me').get()) as AuthJSON;
+		cachedUserInfo = { token: auth.token, userInfo };
 	} catch (err) {
-		cliDebugPrint('[getLoggedClient] error getting user info', { error: err, apiBaseUrl });
-		return null;
+		cliDebugPrint('[getLoggedClient] error getting user info', { error: err });
+		return { client: null, auth, error: err };
 	}
 
-	if (apifyClient.token) {
-		await setToken(apifyClient.token, { skipIfUnchanged: true });
-	}
+	return { client: apifyClient, auth };
+}
 
-	const proxyPassword = userInfo.proxy?.password;
-	if (proxyPassword) {
-		await setProxyPassword(proxyPassword, { skipIfUnchanged: true });
-	}
+/**
+ * Account metadata for the resolved token. An env token has no auth.json entry, so it needs an API
+ * call — kept short because `apify run` waits on this and the client defaults retry for minutes.
+ */
+export async function getCurrentUserInfo(): Promise<AuthJSON> {
+	const auth = await resolveAuth();
+	if (!auth) return getLocalUserInfo();
 
-	ensureApifyDirectory(AUTH_FILE_PATH());
-	const existingFile = (() => {
-		try {
-			return JSON.parse(readFileSync(AUTH_FILE_PATH(), 'utf-8')) as Record<string, unknown>;
-		} catch {
-			return {};
-		}
-	})();
-	const backend = await getBackend();
-	const fileContents: Record<string, unknown> = { ...existingFile, ...userInfo, secretsBackend: backend };
-	if (backend === 'keyring') {
-		delete fileContents.token;
-		if (fileContents.proxy && typeof fileContents.proxy === 'object') {
-			const { password: _password, ...rest } = fileContents.proxy as { password?: string };
-			if (Object.keys(rest).length > 0) {
-				fileContents.proxy = rest;
-			} else {
-				delete fileContents.proxy;
-			}
-		}
-	}
-	writeFileSync(AUTH_FILE_PATH(), JSON.stringify(fileContents, null, '\t'), { mode: 0o600 });
+	if (cachedUserInfo?.token === auth.token) return cachedUserInfo.userInfo;
+	if (auth.source === 'stored') return getLocalUserInfo();
+
+	const apifyClient = new ApifyClient({
+		...getApifyClientOptionsForToken(auth.token),
+		maxRetries: 1,
+		timeoutSecs: 10,
+	});
+	const userInfo = (await apifyClient.user('me').get()) as AuthJSON;
+	cachedUserInfo = { token: auth.token, userInfo };
 
-	return apifyClient;
+	return userInfo;
 }
 
 export const getLocalConfigPath = (cwd: string) => join(cwd, LOCAL_CONFIG_PATH);
diff --git a/test/__setup__/apify-client-mock.ts b/test/__setup__/apify-client-mock.ts
new file mode 100644
index 000000000..8c895dbd4
--- /dev/null
+++ b/test/__setup__/apify-client-mock.ts
@@ -0,0 +1,41 @@
+/**
+ * Stand-in for `apify-client`, so the auth flow runs under `test:local` with no network.
+ *
+ * Install it per file, keeping the real module's other exports — `ApifyApiError` in particular,
+ * which `describeAuthFailure` narrows on:
+ *
+ * ```ts
+ * vi.mock('apify-client', async (importOriginal) => ({
+ *   ...(await importOriginal<typeof import('apify-client')>()),
+ *   ApifyClient: (await import('../../__setup__/apify-client-mock.js')).FakeApifyClient,
+ * }));
+ * ```
+ */
+export const clientState = {
+	user: {} as Record<string, unknown>,
+	fail: false,
+	failWith: undefined as unknown,
+};
+
+export function resetApifyClientMock(user: Record<string, unknown>) {
+	clientState.user = user;
+	clientState.fail = false;
+	clientState.failWith = undefined;
+}
+
+export class FakeApifyClient {
+	token?: string;
+
+	constructor(options: { token?: string }) {
+		this.token = options.token;
+	}
+
+	user() {
+		return {
+			get: async () => {
+				if (clientState.fail) throw clientState.failWith ?? new Error('401');
+				return clientState.user;
+			},
+		};
+	}
+}
diff --git a/test/__setup__/config.ts b/test/__setup__/config.ts
index 3a62b6eeb..bf2e84b5b 100644
--- a/test/__setup__/config.ts
+++ b/test/__setup__/config.ts
@@ -3,7 +3,7 @@ import { EOL } from 'node:os';
 import { ApifyClient } from 'apify-client';
 import { isCI } from 'ci-info';
 
-import { getApifyClientOptions } from '../../src/lib/utils.js';
+import { getApifyClientOptionsForToken } from '../../src/lib/auth.js';
 
 const { TEST_USER_TOKEN: ENV_TEST_USER_TOKEN } = process.env;
 
@@ -13,9 +13,9 @@ if (!ENV_TEST_USER_TOKEN) {
 	throw Error('You must configure "TEST_USER_TOKEN" environment variable to run tests!');
 }
 
-export const testUserClient = new ApifyClient(await getApifyClientOptions(ENV_TEST_USER_TOKEN));
+export const testUserClient = new ApifyClient(getApifyClientOptionsForToken(ENV_TEST_USER_TOKEN));
 
-export const badUserClient = new ApifyClient(await getApifyClientOptions(TEST_USER_BAD_TOKEN));
+export const badUserClient = new ApifyClient(getApifyClientOptionsForToken(TEST_USER_BAD_TOKEN));
 
 export const TEST_USER_TOKEN = ENV_TEST_USER_TOKEN;
 
diff --git a/test/__setup__/hooks/useAuthSetup.ts b/test/__setup__/hooks/useAuthSetup.ts
index aa0ae48e4..e43d1a153 100644
--- a/test/__setup__/hooks/useAuthSetup.ts
+++ b/test/__setup__/hooks/useAuthSetup.ts
@@ -6,10 +6,21 @@ import { isCI } from 'ci-info';
 import { cryptoRandomObjectId } from '@apify/utilities';
 
 import { LoginCommand } from '../../../src/commands/login.js';
+import { __resetAuthForTests } from '../../../src/lib/auth.js';
 import { testRunCommand } from '../../../src/lib/command-framework/apify-command.js';
 import { GLOBAL_CONFIGS_FOLDER } from '../../../src/lib/consts.js';
 import { __resetCredentialsForTests } from '../../../src/lib/credentials.js';
-import { getLocalUserInfo } from '../../../src/lib/utils.js';
+import { __resetUserInfoCacheForTests, getLocalUserInfo } from '../../../src/lib/utils.js';
+
+/**
+ * Every module-level auth cache, cleared together. Kept in one place so adding a cache does not
+ * mean remembering three hook bodies — forgetting one leaks state between tests as a flake.
+ */
+function resetAuthCaches() {
+	__resetCredentialsForTests();
+	__resetUserInfoCacheForTests();
+	__resetAuthForTests();
+}
 
 export interface UseAuthSetupOptions {
 	/**
@@ -43,7 +54,9 @@ export function useAuthSetup({ cleanup = true, perTest = true }: UseAuthSetupOpt
 		// Tests pin to the file backend so they don't touch the real OS keyring.
 		// Unit tests for credentials.ts override this explicitly.
 		vitest.stubEnv('APIFY_DISABLE_KEYRING', '1');
-		__resetCredentialsForTests();
+		// The resolver reads APIFY_TOKEN, so a token in the developer's shell would leak into tests.
+		vitest.stubEnv('APIFY_TOKEN', '');
+		resetAuthCaches();
 	});
 
 	after(async () => {
@@ -51,7 +64,7 @@ export function useAuthSetup({ cleanup = true, perTest = true }: UseAuthSetupOpt
 			await rm(GLOBAL_CONFIGS_FOLDER(), { recursive: true, force: true });
 		}
 
-		__resetCredentialsForTests();
+		resetAuthCaches();
 		vitest.unstubAllEnvs();
 	});
 }
@@ -70,7 +83,7 @@ export function useKeyringBackend() {
 		}
 
 		vitest.stubEnv('APIFY_DISABLE_KEYRING', '');
-		__resetCredentialsForTests();
+		resetAuthCaches();
 	});
 }
 
diff --git a/test/api/commands/info.test.ts b/test/api/commands/info.test.ts
index 91aae86c2..5b037f66a 100644
--- a/test/api/commands/info.test.ts
+++ b/test/api/commands/info.test.ts
@@ -25,7 +25,8 @@ describe('[api] apify info', () => {
 
 		const spy = logSpy();
 
-		expect(spy).toHaveBeenCalledTimes(2);
+		expect(spy).toHaveBeenCalledTimes(3);
 		expect(spy.mock.calls[1][0]).to.include(userInfoFromConfig.id);
+		expect(spy.mock.calls[2][0]).to.include('apify login');
 	});
 });
diff --git a/test/e2e/__helpers__/run-cli.ts b/test/e2e/__helpers__/run-cli.ts
index 99cfae9f9..3915832f8 100644
--- a/test/e2e/__helpers__/run-cli.ts
+++ b/test/e2e/__helpers__/run-cli.ts
@@ -53,6 +53,8 @@ export async function runCli(
 			APIFY_CLI_SKIP_RENTAL_SUNSET_NOTICE: '1',
 			// Pin the file backend so e2e subprocesses don't share the host's OS keyring across tests.
 			APIFY_DISABLE_KEYRING: '1',
+			// The resolver prefers APIFY_TOKEN, so a token on the host would pick the account.
+			APIFY_TOKEN: '',
 			...options.env,
 		},
 	});
diff --git a/test/e2e/commands/builds/lifecycle.test.ts b/test/e2e/commands/builds/lifecycle.test.ts
index 29e9c5644..52c6e1420 100644
--- a/test/e2e/commands/builds/lifecycle.test.ts
+++ b/test/e2e/commands/builds/lifecycle.test.ts
@@ -2,7 +2,7 @@ import { randomBytes } from 'node:crypto';
 
 import { ApifyClient } from 'apify-client';
 
-import { getApifyClientOptions } from '../../../../src/lib/utils.js';
+import { getApifyClientOptionsForToken } from '../../../../src/lib/auth.js';
 import { runCli } from '../../__helpers__/run-cli.js';
 import { createTestActor, removeTestActor, type TestActor } from '../../__helpers__/test-actor.js';
 
@@ -25,7 +25,7 @@ describe('[e2e][api] builds namespace', () => {
 			throw new Error(`Failed to login:\n${loginResult.stderr}`);
 		}
 
-		client = new ApifyClient(await getApifyClientOptions(token));
+		client = new ApifyClient(getApifyClientOptionsForToken(token));
 
 		actor = await createTestActor('e2e-builds');
 
diff --git a/test/e2e/commands/datasets/lifecycle.test.ts b/test/e2e/commands/datasets/lifecycle.test.ts
index b0b2deecf..950772c01 100644
--- a/test/e2e/commands/datasets/lifecycle.test.ts
+++ b/test/e2e/commands/datasets/lifecycle.test.ts
@@ -2,7 +2,7 @@ import { randomBytes } from 'node:crypto';
 
 import { ApifyClient } from 'apify-client';
 
-import { getApifyClientOptions } from '../../../../src/lib/utils.js';
+import { getApifyClientOptionsForToken } from '../../../../src/lib/auth.js';
 import { runCli } from '../../__helpers__/run-cli.js';
 
 describe('[e2e][api] datasets namespace', () => {
@@ -24,7 +24,7 @@ describe('[e2e][api] datasets namespace', () => {
 			throw new Error(`Failed to login:\n${loginResult.stderr}`);
 		}
 
-		client = new ApifyClient(await getApifyClientOptions(token));
+		client = new ApifyClient(getApifyClientOptionsForToken(token));
 	});
 
 	afterAll(async () => {
diff --git a/test/e2e/commands/key-value-stores/lifecycle.test.ts b/test/e2e/commands/key-value-stores/lifecycle.test.ts
index f01399a4b..56f7ccc4c 100644
--- a/test/e2e/commands/key-value-stores/lifecycle.test.ts
+++ b/test/e2e/commands/key-value-stores/lifecycle.test.ts
@@ -2,7 +2,7 @@ import { randomBytes } from 'node:crypto';
 
 import { ApifyClient } from 'apify-client';
 
-import { getApifyClientOptions } from '../../../../src/lib/utils.js';
+import { getApifyClientOptionsForToken } from '../../../../src/lib/auth.js';
 import { runCli } from '../../__helpers__/run-cli.js';
 
 describe('[e2e][api] key-value-stores namespace', () => {
@@ -24,7 +24,7 @@ describe('[e2e][api] key-value-stores namespace', () => {
 			throw new Error(`Failed to login:\n${loginResult.stderr}`);
 		}
 
-		client = new ApifyClient(await getApifyClientOptions(token));
+		client = new ApifyClient(getApifyClientOptionsForToken(token));
 	});
 
 	afterAll(async () => {
diff --git a/test/e2e/commands/runs/lifecycle.test.ts b/test/e2e/commands/runs/lifecycle.test.ts
index aa99a05ad..669259a69 100644
--- a/test/e2e/commands/runs/lifecycle.test.ts
+++ b/test/e2e/commands/runs/lifecycle.test.ts
@@ -4,7 +4,7 @@ import path from 'node:path';
 
 import { ApifyClient } from 'apify-client';
 
-import { getApifyClientOptions } from '../../../../src/lib/utils.js';
+import { getApifyClientOptionsForToken } from '../../../../src/lib/auth.js';
 import { runCli } from '../../__helpers__/run-cli.js';
 import { createTestActor, removeTestActor, type TestActor } from '../../__helpers__/test-actor.js';
 import { TestTmpRoot } from '../../__helpers__/tmp.js';
@@ -28,7 +28,7 @@ describe('[e2e][api] runs lifecycle', () => {
 			throw new Error(`Failed to login:\n${loginResult.stderr}`);
 		}
 
-		client = new ApifyClient(await getApifyClientOptions(token));
+		client = new ApifyClient(getApifyClientOptionsForToken(token));
 		const me = await client.user('me').get();
 
 		actor = await createTestActor('e2e-runs');
diff --git a/test/local/commands/auth.test.ts b/test/local/commands/auth.test.ts
index 43a012881..02f24375f 100644
--- a/test/local/commands/auth.test.ts
+++ b/test/local/commands/auth.test.ts
@@ -1,8 +1,9 @@
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import process from 'node:process';
 
-import { AUTH_FILE_PATH } from '../../../src/lib/consts.js';
+import { AUTH_FILE_PATH, CommandExitCodes } from '../../../src/lib/consts.js';
 import { getToken } from '../../../src/lib/credentials.js';
+import { clientState, resetApifyClientMock } from '../../__setup__/apify-client-mock.js';
 import { useAuthSetup, useKeyringBackend } from '../../__setup__/hooks/useAuthSetup.js';
 import { useConsoleSpy } from '../../__setup__/hooks/useConsoleSpy.js';
 import {
@@ -15,37 +16,11 @@ import {
 
 vi.mock('@napi-rs/keyring', () => import('../../__setup__/keyring-mock.js'));
 
-const { clientState } = vi.hoisted(() => ({
-	clientState: {
-		user: {} as Record<string, unknown>,
-		fail: false,
-	},
+vi.mock('apify-client', async (importOriginal) => ({
+	...(await importOriginal<typeof import('apify-client')>()),
+	ApifyClient: (await import('../../__setup__/apify-client-mock.js')).FakeApifyClient,
 }));
 
-// Stubbing the client is what lets the auth commands run in test:local.
-vi.mock('apify-client', async (importOriginal) => {
-	const actual = await importOriginal<typeof import('apify-client')>();
-
-	class FakeApifyClient {
-		token?: string;
-
-		constructor(options: { token?: string }) {
-			this.token = options.token;
-		}
-
-		user() {
-			return {
-				get: async () => {
-					if (clientState.fail) throw new Error('401');
-					return clientState.user;
-				},
-			};
-		}
-	}
-
-	return { ...actual, ApifyClient: FakeApifyClient };
-});
-
 useAuthSetup();
 const { lastLogMessage, lastErrorMessage } = useConsoleSpy();
 
@@ -62,12 +37,7 @@ const login = (token = TOKEN) => testRunCommand(AuthLoginCommand, { flags_token:
 describe('auth commands', () => {
 	beforeEach(() => {
 		resetKeyringMock();
-		clientState.fail = false;
-		clientState.user = {
-			id: 'uid',
-			username: 'me',
-			proxy: { password: 'pw', groups: [{ name: 'g' }] },
-		};
+		resetApifyClientMock({ id: 'uid', username: 'me', proxy: { password: 'pw', groups: [{ name: 'g' }] } });
 	});
 
 	describe('file backend', () => {
@@ -113,16 +83,94 @@ describe('auth commands', () => {
 
 			const authFile = readAuthFile();
 			expect(authFile).toMatchObject({ token: 'apify_api_other_token', id: 'uid2', username: 'other' });
-			// Known gap: getLoggedClient merges, so the old account's extra fields survive.
-			expect(authFile.email).toBe('me@example.com');
+			// The new account has no email, so the old one must not linger.
+			expect(authFile.email).toBeUndefined();
 		});
 
-		it('login with an invalid token stores nothing', async () => {
+		it('login with an invalid token stores nothing and fails the command', async () => {
 			clientState.fail = true;
 			await login('bad-token');
 
 			expect(lastErrorMessage()).toContain('Login to Apify failed');
 			expect(existsSync(AUTH_FILE_PATH())).toBe(false);
+			// A login that exits 0 lets `apify login --token $BAD && apify push` run on.
+			expect(process.exitCode).toBe(CommandExitCodes.MissingAuth);
+			process.exitCode = 0;
+		});
+
+		it('login fails and stores nothing when APIFY_TOKEN holds a different token', async () => {
+			vitest.stubEnv('APIFY_TOKEN', 'apify_api_env_token');
+
+			await login();
+
+			expect(lastErrorMessage()).toContain('APIFY_TOKEN is set, so other commands will ignore this login');
+			expect(existsSync(AUTH_FILE_PATH())).toBe(false);
+			expect(process.exitCode).toBe(CommandExitCodes.InvalidInput);
+			process.exitCode = 0;
+		});
+
+		it('login goes through when APIFY_TOKEN holds the same token, as CI sets both', async () => {
+			vitest.stubEnv('APIFY_TOKEN', TOKEN);
+
+			await login();
+
+			expect(await getToken()).toBe(TOKEN);
+			expect(lastErrorMessage()).toContain('You are logged in to Apify as me');
+		});
+
+		it('login goes through while APIFY_TOKEN is a placeholder, so a broken one can be fixed', async () => {
+			vitest.stubEnv('APIFY_TOKEN', 'undefined');
+
+			await login();
+
+			expect(await getToken()).toBe(TOKEN);
+			expect(lastErrorMessage()).toContain('You are logged in to Apify as me');
+		});
+
+		it('login says nothing about APIFY_TOKEN when it is not set', async () => {
+			await login();
+
+			expect(lastErrorMessage()).not.toContain('APIFY_TOKEN');
+		});
+
+		it('logout warns that APIFY_TOKEN still authenticates', async () => {
+			await login();
+			vitest.stubEnv('APIFY_TOKEN', 'apify_api_env_token');
+
+			await testRunCommand(AuthLogoutCommand, {});
+
+			expect(existsSync(AUTH_FILE_PATH())).toBe(false);
+			expect(lastErrorMessage()).toContain('APIFY_TOKEN is still set');
+		});
+
+		it('logout says nothing about APIFY_TOKEN when it is not set', async () => {
+			await login();
+
+			await testRunCommand(AuthLogoutCommand, {});
+
+			expect(lastErrorMessage()).not.toContain('APIFY_TOKEN');
+		});
+
+		it('a placeholder APIFY_TOKEN fails the command instead of falling back', async () => {
+			await login();
+			vitest.stubEnv('APIFY_TOKEN', 'undefined');
+
+			await testRunCommand(AuthTokenCommand, {});
+
+			expect(lastErrorMessage()).toContain('APIFY_TOKEN is set to "undefined"');
+			expect(process.exitCode).toBe(CommandExitCodes.InvalidInput);
+			process.exitCode = 0;
+		});
+
+		it('auth token prints APIFY_TOKEN over the stored token, and stores nothing', async () => {
+			await login();
+			vitest.stubEnv('APIFY_TOKEN', 'apify_api_env_token');
+
+			await testRunCommand(AuthTokenCommand, {});
+
+			expect(lastLogMessage()).toBe('apify_api_env_token');
+			expect(await getToken()).toBe(TOKEN);
+			expect(readAuthFile()).toMatchObject({ username: 'me' });
 		});
 	});
 
@@ -149,6 +197,18 @@ describe('auth commands', () => {
 			expect(keyringStore.get(KEYRING_PROXY_PASSWORD_KEY)).toBe('pw');
 		});
 
+		it('logging in as an account with no proxy password forgets the previous one', async () => {
+			await login();
+			expect(keyringStore.get(KEYRING_PROXY_PASSWORD_KEY)).toBe('pw');
+
+			clientState.user = { id: 'uid2', username: 'other' };
+			await login('apify_api_other_token');
+
+			// The keyring outlives the auth.json rewrite, so without an explicit delete the child
+			// Actor would run with the previous account's proxy credential.
+			expect(keyringStore.has(KEYRING_PROXY_PASSWORD_KEY)).toBe(false);
+		});
+
 		it('logging in twice with the same token writes the keyring once', async () => {
 			await login();
 			await login();
diff --git a/test/local/commands/create-git-source.test.ts b/test/local/commands/create-git-source.test.ts
index 8859fc227..8bf1f9bb5 100644
--- a/test/local/commands/create-git-source.test.ts
+++ b/test/local/commands/create-git-source.test.ts
@@ -70,9 +70,11 @@ vitest.mock('../../../src/lib/git-source/gitSource.js', async (importOriginal) =
 }));
 
 // A Git source needs a token; the mocked flow never uses the client, so an empty one is enough.
+// The account needs stubbing too, or the lookup hits the API with whatever token the host has.
 vitest.mock('../../../src/lib/utils.js', async (importOriginal) => ({
 	...(await importOriginal<typeof import('../../../src/lib/utils.js')>()),
 	getLoggedClientOrThrow: vitest.fn(async () => ({})),
+	getCurrentUserInfo: vitest.fn(async () => ({ id: 'userId', username: 'user' })),
 }));
 
 const actName = 'create-git-source-actor';
diff --git a/test/local/commands/push-git-source.test.ts b/test/local/commands/push-git-source.test.ts
index d56a60ec8..bc96a1dcd 100644
--- a/test/local/commands/push-git-source.test.ts
+++ b/test/local/commands/push-git-source.test.ts
@@ -34,7 +34,7 @@ const versionUpdate = vitest.fn(async () => ({}));
 // Stands in for the platform: the Actor exists, and the version's source type is what is under test.
 vitest.mock('../../../src/lib/utils.js', async (importOriginal) => ({
 	...(await importOriginal<typeof import('../../../src/lib/utils.js')>()),
-	getLocalUserInfo: vitest.fn(async () => ({ id: 'userId', username: 'user' })),
+	getCurrentUserInfo: vitest.fn(async () => ({ id: 'userId', username: 'user' })),
 	outputJobLog: vitest.fn(async () => {}),
 	getLoggedClientOrThrow: vitest.fn(async () => ({
 		baseUrl: 'https://api.apify.com/v2',
diff --git a/test/local/lib/auth.test.ts b/test/local/lib/auth.test.ts
new file mode 100644
index 000000000..62c441b36
--- /dev/null
+++ b/test/local/lib/auth.test.ts
@@ -0,0 +1,245 @@
+import { existsSync, readFileSync } from 'node:fs';
+
+import { ApifyApiError } from 'apify-client';
+
+import { loginWithToken, resolveAuth } from '../../../src/lib/auth.js';
+import { AUTH_FILE_PATH, CommandExitCodes } from '../../../src/lib/consts.js';
+import { getProxyPassword, getToken, setToken } from '../../../src/lib/credentials.js';
+import { getCurrentUserInfo, getLoggedClientOrThrow } from '../../../src/lib/utils.js';
+import { clientState, resetApifyClientMock } from '../../__setup__/apify-client-mock.js';
+import { useAuthSetup } from '../../__setup__/hooks/useAuthSetup.js';
+import { useConsoleSpy } from '../../__setup__/hooks/useConsoleSpy.js';
+
+vi.mock('apify-client', async (importOriginal) => ({
+	...(await importOriginal<typeof import('apify-client')>()),
+	ApifyClient: (await import('../../__setup__/apify-client-mock.js')).FakeApifyClient,
+}));
+
+useAuthSetup();
+const { lastErrorMessage, logMessages } = useConsoleSpy();
+
+const STORED = 'apify_api_stored';
+const ENV = 'apify_api_env';
+
+const readAuthFile = () => JSON.parse(readFileSync(AUTH_FILE_PATH(), 'utf-8'));
+
+// A real ApifyApiError, not a look-alike: describeAuthFailure narrows on the class, so a
+// hand-built error would let the 401/403 branch rot without failing a test.
+const apiError = (statusCode: number) =>
+	new ApifyApiError(
+		{ status: statusCode, data: { error: { message: 'nope' } }, config: {}, headers: {}, statusText: '' } as never,
+		1,
+	);
+
+describe('auth', () => {
+	beforeEach(() => {
+		resetApifyClientMock({ id: 'uid', username: 'me', proxy: { password: 'pw' } });
+	});
+
+	describe('resolveAuth()', () => {
+		afterEach(() => {
+			// The command framework reads this; leaving it set would fail the vitest run.
+			process.exitCode = 0;
+		});
+
+		it('returns undefined when no token is available', async () => {
+			await expect(resolveAuth()).resolves.toBeUndefined();
+		});
+
+		it('resolves the stored login when nothing overrides it', async () => {
+			await loginWithToken(STORED);
+
+			await expect(resolveAuth()).resolves.toEqual({ token: STORED, source: 'stored' });
+		});
+
+		it('prefers APIFY_TOKEN over the stored login', async () => {
+			await loginWithToken(STORED);
+			vitest.stubEnv('APIFY_TOKEN', ENV);
+
+			await expect(resolveAuth()).resolves.toEqual({ token: ENV, source: 'env' });
+		});
+
+		it.each(['undefined', 'null', 'NaN', 'none', '0', '-'])(
+			'fails instead of falling back when APIFY_TOKEN is the placeholder %j',
+			async (placeholder) => {
+				await loginWithToken(STORED);
+				vitest.stubEnv('APIFY_TOKEN', placeholder);
+
+				await expect(resolveAuth()).rejects.toThrow(`APIFY_TOKEN is set to "${placeholder}"`);
+				expect(process.exitCode).toBe(CommandExitCodes.InvalidInput);
+			},
+		);
+
+		it('says how to fix a placeholder APIFY_TOKEN', async () => {
+			vitest.stubEnv('APIFY_TOKEN', 'undefined');
+
+			await expect(resolveAuth()).rejects.toThrow('Unset APIFY_TOKEN and try again');
+		});
+
+		it.each(['', '   '])(
+			'falls back to the stored login without a word when APIFY_TOKEN is blank %j',
+			async (blank) => {
+				await loginWithToken(STORED);
+				vitest.stubEnv('APIFY_TOKEN', blank);
+
+				await expect(resolveAuth()).resolves.toEqual({ token: STORED, source: 'stored' });
+				expect(lastErrorMessage()).toBeUndefined();
+			},
+		);
+
+		it('trims surrounding whitespace off APIFY_TOKEN', async () => {
+			vitest.stubEnv('APIFY_TOKEN', `  ${ENV}  `);
+
+			await expect(resolveAuth()).resolves.toEqual({ token: ENV, source: 'env' });
+		});
+
+		it('says so when APIFY_TOKEN overrides a stored login', async () => {
+			await loginWithToken(STORED);
+			vitest.stubEnv('APIFY_TOKEN', ENV);
+
+			await resolveAuth();
+
+			expect(lastErrorMessage()).toContain('Using the API token from APIFY_TOKEN.');
+		});
+
+		it('says nothing when APIFY_TOKEN is the only credential', async () => {
+			vitest.stubEnv('APIFY_TOKEN', ENV);
+
+			await resolveAuth();
+
+			expect(lastErrorMessage()).toBeUndefined();
+		});
+
+		it('resolves once per process, so the notice is not repeated per caller', async () => {
+			await loginWithToken(STORED);
+			vitest.stubEnv('APIFY_TOKEN', ENV);
+
+			await resolveAuth();
+			await resolveAuth();
+			await resolveAuth();
+
+			expect(logMessages.error.filter((message) => message.includes('Using the API token'))).toHaveLength(1);
+		});
+
+		it('resolves APIFY_TOKEN with no stored login, as inside a platform run', async () => {
+			vitest.stubEnv('APIFY_TOKEN', ENV);
+
+			await expect(resolveAuth()).resolves.toEqual({ token: ENV, source: 'env' });
+			expect(existsSync(AUTH_FILE_PATH())).toBe(false);
+		});
+	});
+
+	describe('loginWithToken()', () => {
+		it('saves the token, the proxy password and the account metadata', async () => {
+			await loginWithToken(STORED);
+
+			expect(await getToken()).toBe(STORED);
+			expect(await getProxyPassword()).toBe('pw');
+			expect(readAuthFile()).toMatchObject({ id: 'uid', username: 'me' });
+		});
+
+		it('writes nothing when the API rejects the token', async () => {
+			clientState.fail = true;
+
+			await expect(loginWithToken(STORED)).resolves.toBeNull();
+			expect(existsSync(AUTH_FILE_PATH())).toBe(false);
+		});
+
+		it('ignores APIFY_TOKEN and saves the token it was given', async () => {
+			vitest.stubEnv('APIFY_TOKEN', ENV);
+
+			await loginWithToken(STORED);
+
+			expect(await getToken()).toBe(STORED);
+		});
+	});
+
+	describe('getLoggedClientOrThrow()', () => {
+		afterEach(() => {
+			// The command framework reads this; leaving it set would fail the vitest run.
+			process.exitCode = 0;
+		});
+
+		it('reports not being logged in when no token resolves', async () => {
+			await expect(getLoggedClientOrThrow()).rejects.toThrow('You are not logged in');
+		});
+
+		it('names APIFY_TOKEN as the source of a rejected token', async () => {
+			await loginWithToken(STORED);
+			vitest.stubEnv('APIFY_TOKEN', ENV);
+			clientState.fail = true;
+			clientState.failWith = apiError(401);
+
+			await expect(getLoggedClientOrThrow()).rejects.toThrow(`The API token in APIFY_TOKEN was rejected`);
+		});
+
+		it('names the stored login as the source of a rejected token', async () => {
+			await loginWithToken(STORED);
+			clientState.fail = true;
+			clientState.failWith = apiError(403);
+
+			await expect(getLoggedClientOrThrow()).rejects.toThrow('Your stored API token was rejected');
+		});
+
+		it('does not blame the token when the API request itself failed', async () => {
+			await loginWithToken(STORED);
+			clientState.fail = true;
+			clientState.failWith = new Error('getaddrinfo ENOTFOUND api.apify.com');
+
+			await expect(getLoggedClientOrThrow()).rejects.toThrow('The Apify API request failed');
+		});
+	});
+
+	describe('getCurrentUserInfo()', () => {
+		it('reads auth.json for a stored token, without touching the API', async () => {
+			await loginWithToken(STORED);
+			clientState.fail = true;
+
+			await expect(getCurrentUserInfo()).resolves.toMatchObject({ username: 'me', id: 'uid' });
+		});
+
+		it('fetches the account behind APIFY_TOKEN rather than the stored one', async () => {
+			await loginWithToken(STORED);
+			vitest.stubEnv('APIFY_TOKEN', ENV);
+			clientState.user = { id: 'uid2', username: 'other' };
+
+			await expect(getCurrentUserInfo()).resolves.toMatchObject({ username: 'other', id: 'uid2' });
+		});
+
+		it('reuses the account the client lookup already fetched', async () => {
+			await loginWithToken(STORED);
+			vitest.stubEnv('APIFY_TOKEN', ENV);
+			clientState.user = { id: 'uid2', username: 'other' };
+			await getLoggedClientOrThrow();
+
+			// A second API call would throw here; the cache is what keeps this green.
+			clientState.fail = true;
+
+			await expect(getCurrentUserInfo()).resolves.toMatchObject({ username: 'other' });
+		});
+
+		it('prefers that cache over auth.json on the stored path, so a rename is picked up', async () => {
+			await loginWithToken(STORED);
+			clientState.user = { id: 'uid', username: 'renamed' };
+			await getLoggedClientOrThrow();
+
+			await expect(getCurrentUserInfo()).resolves.toMatchObject({ username: 'renamed' });
+		});
+
+		it('returns an empty account when no token resolves', async () => {
+			await expect(getCurrentUserInfo()).resolves.toEqual({});
+		});
+	});
+
+	describe('read paths do not persist', () => {
+		it('resolving APIFY_TOKEN leaves the stored login untouched', async () => {
+			await loginWithToken(STORED);
+			vitest.stubEnv('APIFY_TOKEN', ENV);
+
+			await resolveAuth();
+
+			expect(await getToken()).toBe(STORED);
+			expect(readAuthFile()).toMatchObject({ username: 'me' });
+		});
+	});
+});
diff --git a/test/local/lib/credentials.test.ts b/test/local/lib/credentials.test.ts
index d11d0f111..991cd5a46 100644
--- a/test/local/lib/credentials.test.ts
+++ b/test/local/lib/credentials.test.ts
@@ -4,6 +4,7 @@ import process from 'node:process';
 
 import { cryptoRandomObjectId } from '@apify/utilities';
 
+import { resolveAuth } from '../../../src/lib/auth.js';
 import { AUTH_FILE_PATH, GLOBAL_CONFIGS_FOLDER } from '../../../src/lib/consts.js';
 import {
 	__resetCredentialsForTests,
@@ -15,7 +16,7 @@ import {
 	setProxyPassword,
 	setToken,
 } from '../../../src/lib/credentials.js';
-import { getApifyClientOptions, getLocalUserInfo } from '../../../src/lib/utils.js';
+import { getLocalUserInfo } from '../../../src/lib/utils.js';
 import {
 	KEYRING_PROXY_PASSWORD_KEY,
 	KEYRING_TOKEN_KEY,
@@ -46,6 +47,8 @@ const readAuthFile = () => JSON.parse(readFileSync(AUTH_FILE_PATH(), 'utf-8'));
 describe('credentials', () => {
 	beforeEach(() => {
 		vitest.stubEnv('__APIFY_INTERNAL_TEST_AUTH_PATH__', cryptoRandomObjectId(12));
+		// The resolver reads APIFY_TOKEN, so a token in the developer's shell would leak into tests.
+		vitest.stubEnv('APIFY_TOKEN', '');
 		resetKeyringMock();
 		writeFileSyncSpy.mockClear();
 		__resetCredentialsForTests();
@@ -226,6 +229,14 @@ describe('credentials', () => {
 	});
 
 	describe('ensureMigrated()', () => {
+		it('runs when resolveAuth reads a pre-migration auth.json', async () => {
+			vitest.stubEnv('APIFY_DISABLE_KEYRING', '1');
+			writeAuthFile({ username: 'me', id: 'uid', token: 'tok_legacy' });
+
+			expect((await resolveAuth())?.token).toBe('tok_legacy');
+			expect(readAuthFile().secretsBackend).toBe('file');
+		});
+
 		it('is a no-op when secretsBackend marker is already set', async () => {
 			vitest.stubEnv('APIFY_DISABLE_KEYRING', '1');
 			writeAuthFile({ token: 'tok', secretsBackend: 'file' });
@@ -366,30 +377,4 @@ describe('credentials', () => {
 			await expect(getLocalUserInfo()).rejects.toThrow('Stale credentials found without user metadata');
 		});
 	});
-
-	describe('getApifyClientOptions()', () => {
-		beforeEach(() => {
-			vitest.stubEnv('APIFY_DISABLE_KEYRING', '1');
-		});
-
-		it('resolves the stored token when nothing overrides it', async () => {
-			await setToken('tok_stored');
-			expect((await getApifyClientOptions()).token).toBe('tok_stored');
-		});
-
-		it('prefers an explicitly passed token over the stored one', async () => {
-			await setToken('tok_stored');
-			expect((await getApifyClientOptions('tok_explicit')).token).toBe('tok_explicit');
-		});
-
-		it('resolves a pre-migration auth.json and stamps the backend marker', async () => {
-			writeAuthFile({ username: 'me', id: 'uid', token: 'tok_legacy' });
-			expect((await getApifyClientOptions()).token).toBe('tok_legacy');
-			expect(readAuthFile().secretsBackend).toBe('file');
-		});
-
-		it('resolves to undefined when no token is stored', async () => {
-			expect((await getApifyClientOptions()).token).toBeUndefined();
-		});
-	});
 });