Env org-auth token host claim ignored when picking request base URL

Open

#1,568 opened on Sep 9, 2026 0 comments 2 reactions 1 assignee View on GitHub

@BYK is already working on this.

Since Sep 9, 2026.

Assessment

This issue has not been assessed yet.

Description

bug jared

When only SENTRY_AUTH_TOKEN is set (an sntrys_ org-auth token embedding a custom instance URL, e.g. http://localhost:8000) and no SENTRY_URL/SENTRY_HOST/--url is provided, commands such as sentry debug-files upload fail with:

Error: Credentials: https://sentry.io
Refusing to route requests here because it doesn't match the host your Sentry credentials are for (http://localhost:8000).
To use this host, run: sentry auth login --url https://sentry.io
To keep using your current credentials, remove this URL override.

Running sentry auth logout first does not help; the same error persists.

Root cause (source-verified):

getConfiguredSentryUrl() in packages/cli/src/lib/constants.ts (used by getApiBaseUrl()/getControlSiloUrl() in lib/sentry-client.ts) only reads SENTRY_HOST/SENTRY_URL and otherwise falls back to DEFAULT_SENTRY_URL (https://sentry.io). It never consults the sntrys_ token's embedded url claim.
Separately, getActiveTokenHost() in lib/env-token-host.ts / lib/token-host.ts does treat the org-auth token's embedded claim URL as authoritative for the host-scope trust check.
With only SENTRY_AUTH_TOKEN set, these two resolutions disagree: the actual request destination defaults to https://sentry.io, while the trust check computes the token's host as the claim URL (http://localhost:8000). The mismatch trips the host-scoping guard added for credential-leak protection (lib/token-host.ts, lib/errors.ts), producing the confusing "Refusing to route requests" error even though no host override was intentionally requested.
sentry-cli (the legacy Rust CLI) does not have this host-scoping guard and does not exhibit the regression, which is why it "works flawlessly" for the same credentials.

Reported by Daniel Szoke.

via Daniel Szoke.

View Junior Session [Sentry]

Dominant language: TypeScript
Stars: 121
Forks: 14
Avg merge: 23h 54m
Merged PRs (30d): 103

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

ls -i / --inode not supported ("invalid option -- i"), breaks autoconf's `ls -di .` working-directory check Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

vercel-labs/just-bash#464 · Opened Sep 24, 2026
looksLikeSlug() is ASCII-only, so non-Latin entity slugs (e.g. Korean) skip exact match and collapse Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

garrytan/gbrain#5421 · Opened Sep 24, 2026
Passer le formulaire de publication en BAL 1.5 par défaut Open

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

BaseAdresseNationale/adresse.data.gouv.fr#2583 · Opened Sep 24, 2026
🎙️ task - fix(tests-node): the shipped catch ships cause error where error is unknown Open

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

ehmpathy/declapract-typescript-ehmpathy#632 · Opened Sep 24, 2026
Search modal renders beneath the open AI dock (shared --z-overlay) Open

Difficulty 1/5 Under an hour Newbie friendliness 90/100

TanStack/tanstack.com#1293 · Opened Sep 24, 2026

More TypeScript issues