Env org-auth token host claim ignored when picking request base URL

[sentry-junior]

When only SENTRY_AUTH_TOKEN is set (an sntrys_ org-auth token embedding a custom instance URL, e.g. http://localhost:8000) and no SENTRY_URL/SENTRY_HOST/--url is provided, commands such as sentry debug-files upload fail with:

Error: Credentials: https://sentry.io
Refusing to route requests here because it doesn't match the host your Sentry credentials are for (http://localhost:8000).
To use this host, run: sentry auth login --url https://sentry.io
To keep using your current credentials, remove this URL override.

Running sentry auth logout first does not help; the same error persists.

Root cause (source-verified):

• getConfiguredSentryUrl() in packages/cli/src/lib/constants.ts (used by getApiBaseUrl()/getControlSiloUrl() in lib/sentry-client.ts) only reads SENTRY_HOST/SENTRY_URL and otherwise falls back to DEFAULT_SENTRY_URL (https://sentry.io). It never consults the sntrys_ token's embedded url claim.
• Separately, getActiveTokenHost() in lib/env-token-host.ts / lib/token-host.ts does treat the org-auth token's embedded claim URL as authoritative for the host-scope trust check.
• With only SENTRY_AUTH_TOKEN set, these two resolutions disagree: the actual request destination defaults to https://sentry.io, while the trust check computes the token's host as the claim URL (http://localhost:8000). The mismatch trips the host-scoping guard added for credential-leak protection (lib/token-host.ts, lib/errors.ts), producing the confusing "Refusing to route requests" error even though no host override was intentionally requested.
• sentry-cli (the legacy Rust CLI) does not have this host-scoping guard and does not exhibit the regression, which is why it "works flawlessly" for the same credentials.

Reported by Daniel Szoke.

via Daniel Szoke.

--

View Junior Session [Sentry]