diff --git a/docs/reference.md b/docs/reference.md
index e7cf2fb73..f61b558bf 100644
--- a/docs/reference.md
+++ b/docs/reference.md
@@ -149,7 +149,8 @@ SUBCOMMANDS
                to '~/.apify/auth.json'.
   auth logout  Removes authentication by deleting your API token and
                account information from '~/.apify/auth.json'.
-  auth token   Prints the current API token for the Apify CLI.
+  auth token   Prints the API token the CLI would use, resolved from
+               APIFY_TOKEN or the stored login.
 ```
 
 ##### `apify auth login` / `apify login`
@@ -168,7 +169,8 @@ USAGE
 FLAGS
   -m, --method=<option>  Method of logging in to Apify.
                          <options: console|manual>
-  -t, --token=<value>    Apify API token.
+  -t, --token=<value>    Apify API token to log in with and
+                         save. APIFY_TOKEN is deliberately ignored here.
 ```
 
 ##### `apify auth logout` / `apify logout`
@@ -187,7 +189,8 @@ USAGE
 
 ```sh
 DESCRIPTION
-  Prints the current API token for the Apify CLI.
+  Prints the API token the CLI would use, resolved from APIFY_TOKEN or the 
+  stored login.
 
 USAGE
   $ apify auth token
@@ -1796,7 +1799,7 @@ ARGUMENTS
 
 FLAGS
   -t, --token=<value>  Apify API token to embed in the config.
-                       Defaults to the token from 'apify login'.
+                       Defaults to APIFY_TOKEN, then the token from 'apify login'.
       --tools=<value>  Comma-separated tool IDs or Actor full names
                        to expose. Forwarded as a '?tools=' query parameter.
       --url=<value>    Apify MCP server URL.
diff --git a/src/commands/actor/charge.ts b/src/commands/actor/charge.ts
index dc2bd9ebb..49f7ada03 100644
--- a/src/commands/actor/charge.ts
+++ b/src/commands/actor/charge.ts
@@ -1,11 +1,10 @@
 import { APIFY_ENV_VARS } from '@apify/consts';
 
-import { getApifyTokenFromEnvOrAuthFile } from '../../lib/actor.js';
 import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { Args } from '../../lib/command-framework/args.js';
 import { Flags } from '../../lib/command-framework/flags.js';
 import { info } from '../../lib/outputs.js';
-import { getLoggedClient } from '../../lib/utils.js';
+import { getLoggedClientOrThrow } from '../../lib/utils.js';
 
 /**
  * This command can be used to charge for a specific event in the pay-per-event Actor run.
@@ -86,11 +85,7 @@ export class ActorChargeCommand extends ApifyCommand<typeof ActorChargeCommand>
 			return;
 		}
 
-		const apifyToken = await getApifyTokenFromEnvOrAuthFile();
-		const apifyClient = await getLoggedClient(apifyToken);
-		if (!apifyClient) {
-			throw new Error('Apify token is not set. Please set it using the environment variable APIFY_TOKEN.');
-		}
+		const apifyClient = await getLoggedClientOrThrow();
 		const runId = process.env[APIFY_ENV_VARS.ACTOR_RUN_ID];
 
 		if (!runId) {
diff --git a/src/commands/actors/call.ts b/src/commands/actors/call.ts
index e5f31e25d..01363f7ba 100644
--- a/src/commands/actors/call.ts
+++ b/src/commands/actors/call.ts
@@ -20,7 +20,7 @@ import { runActorOrTaskOnCloud, SharedRunOnCloudFlags } from '../../lib/commands
 import { finalizeRun, runUrl } from '../../lib/commands/run-result.js';
 import { CommandExitCodes, LOCAL_CONFIG_PATH } from '../../lib/consts.js';
 import { error, simpleLog } from '../../lib/outputs.js';
-import { getLocalConfig, getLocalUserInfo, getLoggedClientOrThrow, TimestampFormatter } from '../../lib/utils.js';
+import { getLocalConfig, getCurrentUserInfo, getLoggedClientOrThrow, TimestampFormatter } from '../../lib/utils.js';
 
 export class ActorsCallCommand extends ApifyCommand<typeof ActorsCallCommand> {
 	static override name = 'call' as const;
@@ -102,7 +102,7 @@ export class ActorsCallCommand extends ApifyCommand<typeof ActorsCallCommand> {
 		const cwd = process.cwd();
 		const localConfig = getLocalConfig(cwd) || {};
 		const apifyClient = await getLoggedClientOrThrow();
-		const userInfo = await getLocalUserInfo();
+		const userInfo = await getCurrentUserInfo();
 		const usernameOrId = userInfo.username || (userInfo.id as string);
 
 		if (this.flags.json && this.flags.outputDataset) {
diff --git a/src/commands/actors/pull.ts b/src/commands/actors/pull.ts
index 3d5d34027..feb526e60 100644
--- a/src/commands/actors/pull.ts
+++ b/src/commands/actors/pull.ts
@@ -12,7 +12,7 @@ import { Flags } from '../../lib/command-framework/flags.js';
 import { CommandExitCodes, LOCAL_CONFIG_PATH } from '../../lib/consts.js';
 import { useActorConfig } from '../../lib/hooks/useActorConfig.js';
 import { error, success } from '../../lib/outputs.js';
-import { downloadZip, getLocalUserInfo, getLoggedClientOrThrow } from '../../lib/utils.js';
+import { downloadZip, getCurrentUserInfo, getLoggedClientOrThrow } from '../../lib/utils.js';
 
 const extractGitHubZip = async (url: string, directoryPath: string) => {
 	const zipFile = await downloadZip(url);
@@ -80,8 +80,8 @@ export class ActorsPullCommand extends ApifyCommand<typeof ActorsPullCommand> {
 
 		const { config: actorConfig } = actorConfigResult.unwrap();
 
-		const userInfo = await getLocalUserInfo();
 		const apifyClient = await getLoggedClientOrThrow();
+		const userInfo = await getCurrentUserInfo();
 
 		const isActorAutomaticallyDetected = !this.args.actorId;
 		const usernameOrId = userInfo.username || userInfo.id;
diff --git a/src/commands/actors/push.ts b/src/commands/actors/push.ts
index 2c7a5a7b5..e642c9a7d 100644
--- a/src/commands/actors/push.ts
+++ b/src/commands/actors/push.ts
@@ -29,7 +29,7 @@ import {
 	createActZip,
 	createSourceFiles,
 	getActorLocalFilePaths,
-	getLocalUserInfo,
+	getCurrentUserInfo,
 	getLoggedClientOrThrow,
 	outputJobLog,
 	parseWaitForFinishMillis,
@@ -287,7 +287,7 @@ export class ActorsPushCommand extends ApifyCommand<typeof ActorsPushCommand> {
 
 		const { config: actorConfig } = actorConfigResult.unwrap();
 
-		const userInfo = await getLocalUserInfo();
+		const userInfo = await getCurrentUserInfo();
 		const isOrganizationLoggedIn = !!userInfo.organizationOwnerUserId;
 		const redirectUrlPart = isOrganizationLoggedIn ? `/organization/${userInfo.id}` : '';
 
diff --git a/src/commands/actors/search.ts b/src/commands/actors/search.ts
index 49712a95e..dd1978c6f 100644
--- a/src/commands/actors/search.ts
+++ b/src/commands/actors/search.ts
@@ -1,13 +1,14 @@
 import { ApifyClient } from 'apify-client';
 import chalk from 'chalk';
 
+import { getAnonymousApifyClientOptions } from '../../lib/auth.js';
 import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { Args } from '../../lib/command-framework/args.js';
 import { Flags } from '../../lib/command-framework/flags.js';
 import { CompactMode, ResponsiveTable } from '../../lib/commands/responsive-table.js';
 import { CommandExitCodes } from '../../lib/consts.js';
 import { error, info, simpleLog } from '../../lib/outputs.js';
-import { getApifyClientOptions, printJsonToStdout } from '../../lib/utils.js';
+import { printJsonToStdout } from '../../lib/utils.js';
 
 const pricingModelLabels: Record<string, string> = {
 	FREE: 'Free',
@@ -96,9 +97,7 @@ export class ActorsSearchCommand extends ApifyCommand<typeof ActorsSearchCommand
 		const { query } = this.args;
 		const { json, sortBy, category, username, pricingModel, limit, offset } = this.flags;
 
-		const clientOptions = await getApifyClientOptions();
-		delete clientOptions.token;
-		const client = new ApifyClient(clientOptions);
+		const client = new ApifyClient(getAnonymousApifyClientOptions());
 
 		let result;
 
diff --git a/src/commands/actors/start.ts b/src/commands/actors/start.ts
index 164d04c6e..3ff5cb45e 100644
--- a/src/commands/actors/start.ts
+++ b/src/commands/actors/start.ts
@@ -12,7 +12,7 @@ import { runActorOrTaskOnCloud, SharedRunOnCloudFlags } from '../../lib/commands
 import { getConsoleUrl } from '../../lib/console-url.js';
 import { LOCAL_CONFIG_PATH } from '../../lib/consts.js';
 import { simpleLog } from '../../lib/outputs.js';
-import { getLocalConfig, getLocalUserInfo, getLoggedClientOrThrow, printJsonToStdout } from '../../lib/utils.js';
+import { getLocalConfig, getCurrentUserInfo, getLoggedClientOrThrow, printJsonToStdout } from '../../lib/utils.js';
 import { ActorsCallCommand } from './call.js';
 
 export class ActorsStartCommand extends ApifyCommand<typeof ActorsStartCommand> {
@@ -73,7 +73,7 @@ export class ActorsStartCommand extends ApifyCommand<typeof ActorsStartCommand>
 		const cwd = process.cwd();
 		const localConfig = getLocalConfig(cwd) || {};
 		const apifyClient = await getLoggedClientOrThrow();
-		const userInfo = await getLocalUserInfo();
+		const userInfo = await getCurrentUserInfo();
 		const usernameOrId = userInfo.username || (userInfo.id as string);
 
 		const {
diff --git a/src/commands/auth/login.ts b/src/commands/auth/login.ts
index d1799d1c6..d50ba2a85 100644
--- a/src/commands/auth/login.ts
+++ b/src/commands/auth/login.ts
@@ -5,19 +5,21 @@ import chalk from 'chalk';
 import computerName from 'computer-name';
 import open from 'open';
 
+import { APIFY_ENV_VARS } from '@apify/consts';
 import { cryptoRandomObjectId } from '@apify/utilities';
 
+import { getEnvToken, loginWithToken } from '../../lib/auth.js';
 import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { Flags } from '../../lib/command-framework/flags.js';
 import { getConsoleIntegrationsUrl, getConsoleUrl } from '../../lib/console-url.js';
-import { AUTH_FILE_PATH } from '../../lib/consts.js';
+import { AUTH_FILE_PATH, CommandExitCodes } from '../../lib/consts.js';
 import { getBackend } from '../../lib/credentials.js';
 import { updateUserId } from '../../lib/hooks/telemetry/useTelemetryState.js';
 import { useMaskedInput } from '../../lib/hooks/user-confirmations/useMaskedInput.js';
 import { useSelectFromList } from '../../lib/hooks/user-confirmations/useSelectFromList.js';
 import { createLocalApiServer } from '../../lib/local-api-server.js';
-import { error, info, success } from '../../lib/outputs.js';
-import { getLocalUserInfo, getLoggedClient, tildify } from '../../lib/utils.js';
+import { error, info, success, warning } from '../../lib/outputs.js';
+import { getLocalUserInfo, tildify } from '../../lib/utils.js';
 
 // When logging in against a local Console instance (local platform development), validate the token
 // against the local API rather than production.
@@ -28,7 +30,7 @@ const API_VERSION = 'v1';
 
 const tryToLogin = async (token: string) => {
 	const apiBaseUrl = getConsoleUrl().includes('localhost') ? LOCAL_API_BASE_URL : undefined;
-	const isUserLogged = await getLoggedClient(token, apiBaseUrl);
+	const isUserLogged = await loginWithToken(token, apiBaseUrl);
 	const userInfo = await getLocalUserInfo();
 
 	if (isUserLogged) {
@@ -46,7 +48,14 @@ const tryToLogin = async (token: string) => {
 		success({
 			message: `You are logged in to Apify as ${userInfo.username || userInfo.id}. ${chalk.gray(`Your token is stored in ${tokenLocation}.`)}`,
 		});
+
+		if (getEnvToken()) {
+			warning({
+				message: `${APIFY_ENV_VARS.TOKEN} is set, so other commands keep using that token instead of this login. Unset it to use this account.`,
+			});
+		}
 	} else {
+		process.exitCode = CommandExitCodes.MissingAuth;
 		error({
 			message: 'Login to Apify failed, the provided API token is not valid.',
 		});
@@ -85,7 +94,7 @@ export class AuthLoginCommand extends ApifyCommand<typeof AuthLoginCommand> {
 	static override flags = {
 		token: Flags.string({
 			char: 't',
-			description: 'Apify API token.',
+			description: 'Apify API token to log in with and save. APIFY_TOKEN is deliberately ignored here.',
 			required: false,
 		}),
 		method: Flags.string({
diff --git a/src/commands/auth/logout.ts b/src/commands/auth/logout.ts
index fbf73807d..936403e80 100644
--- a/src/commands/auth/logout.ts
+++ b/src/commands/auth/logout.ts
@@ -1,9 +1,12 @@
+import { APIFY_ENV_VARS } from '@apify/consts';
+
+import { getEnvToken } from '../../lib/auth.js';
 import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { AUTH_FILE_PATH } from '../../lib/consts.js';
 import { clearKeyringSecrets } from '../../lib/credentials.js';
 import { rimrafPromised } from '../../lib/files.js';
 import { updateUserId } from '../../lib/hooks/telemetry/useTelemetryState.js';
-import { success } from '../../lib/outputs.js';
+import { success, warning } from '../../lib/outputs.js';
 import { tildify } from '../../lib/utils.js';
 
 export class AuthLogoutCommand extends ApifyCommand<typeof AuthLogoutCommand> {
@@ -31,5 +34,11 @@ export class AuthLogoutCommand extends ApifyCommand<typeof AuthLogoutCommand> {
 		await updateUserId(null);
 
 		success({ message: 'You are logged out from your Apify account.' });
+
+		if (getEnvToken()) {
+			warning({
+				message: `${APIFY_ENV_VARS.TOKEN} is still set, so commands stay authenticated with that token.`,
+			});
+		}
 	}
 }
diff --git a/src/commands/auth/token.ts b/src/commands/auth/token.ts
index c2a307e88..fbb033bf8 100644
--- a/src/commands/auth/token.ts
+++ b/src/commands/auth/token.ts
@@ -1,15 +1,17 @@
+import { resolveAuth } from '../../lib/auth.js';
 import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { simpleLog } from '../../lib/outputs.js';
-import { getLocalUserInfo, getLoggedClientOrThrow } from '../../lib/utils.js';
+import { getLoggedClientOrThrow } from '../../lib/utils.js';
 
 export class AuthTokenCommand extends ApifyCommand<typeof AuthTokenCommand> {
 	static override name = 'token' as const;
 
-	static override description = 'Prints the current API token for the Apify CLI.';
+	static override description =
+		'Prints the API token the CLI would use, resolved from APIFY_TOKEN or the stored login.';
 
 	static override examples = [
 		{
-			description: 'Print the stored API token to stdout (use with care — it is a secret).',
+			description: 'Print the resolved API token to stdout (use with care — it is a secret).',
 			command: 'apify auth token',
 		},
 	];
@@ -18,10 +20,10 @@ export class AuthTokenCommand extends ApifyCommand<typeof AuthTokenCommand> {
 
 	async run() {
 		await getLoggedClientOrThrow();
-		const userInfo = await getLocalUserInfo();
+		const auth = await resolveAuth();
 
-		if (userInfo.token) {
-			simpleLog({ message: userInfo.token, stdout: true });
+		if (auth) {
+			simpleLog({ message: auth.token, stdout: true });
 		}
 	}
 }
diff --git a/src/commands/create.ts b/src/commands/create.ts
index 1e4f05183..c9e487f93 100644
--- a/src/commands/create.ts
+++ b/src/commands/create.ts
@@ -50,7 +50,7 @@ import { LANGUAGE_FLAG_CHOICES, USE_CASE_FLAG_CHOICES } from '../lib/templates/c
 import {
 	downloadAndUnzip,
 	getJsonFileContent,
-	getLocalUserInfo,
+	getCurrentUserInfo,
 	getLoggedClientOrThrow,
 	isNodeVersionSupported,
 	isPythonVersionSupported,
@@ -317,8 +317,7 @@ export class CreateCommand extends ApifyCommand<typeof CreateCommand> {
 			? {
 					provider: gitProvider,
 					client: await getLoggedClientOrThrow(),
-					// Read after the client, which refreshes auth.json from the token the run resolved.
-					account: toGitAccount(await getLocalUserInfo()),
+					account: toGitAccount(await getCurrentUserInfo()),
 					// Omitted means on: the webhook is what makes a Git-sourced Actor rebuild on a push.
 					autoBuild: this.flags.autoBuild !== 'off',
 					...parseGitRepoFlag(gitRepo, actorName),
diff --git a/src/commands/datasets/get-items.ts b/src/commands/datasets/get-items.ts
index 93bf6847f..d06cf9555 100644
--- a/src/commands/datasets/get-items.ts
+++ b/src/commands/datasets/get-items.ts
@@ -4,7 +4,7 @@ import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { Args } from '../../lib/command-framework/args.js';
 import { Flags } from '../../lib/command-framework/flags.js';
 import { error, simpleLog } from '../../lib/outputs.js';
-import { getLocalUserInfo, getLoggedClientOrThrow } from '../../lib/utils.js';
+import { getCurrentUserInfo, getLoggedClientOrThrow } from '../../lib/utils.js';
 
 const downloadFormatToContentType: Record<DownloadItemsFormat, string> = {
 	[DownloadItemsFormat.JSON]: 'application/json',
@@ -106,7 +106,7 @@ export class DatasetsGetItems extends ApifyCommand<typeof DatasetsGetItems> {
 			};
 		}
 
-		const info = await getLocalUserInfo();
+		const info = await getCurrentUserInfo();
 
 		const byName = await client
 			.dataset(`${info.username!}/${datasetId}`)
diff --git a/src/commands/datasets/ls.ts b/src/commands/datasets/ls.ts
index 2a6102b39..793647a0a 100644
--- a/src/commands/datasets/ls.ts
+++ b/src/commands/datasets/ls.ts
@@ -5,7 +5,7 @@ import { Flags } from '../../lib/command-framework/flags.js';
 import { prettyPrintBytes } from '../../lib/commands/pretty-print-bytes.js';
 import { CompactMode, ResponsiveTable } from '../../lib/commands/responsive-table.js';
 import { info, simpleLog } from '../../lib/outputs.js';
-import { getLocalUserInfo, getLoggedClientOrThrow, printJsonToStdout, TimestampFormatter } from '../../lib/utils.js';
+import { getCurrentUserInfo, getLoggedClientOrThrow, printJsonToStdout, TimestampFormatter } from '../../lib/utils.js';
 
 const table = new ResponsiveTable({
 	allColumns: ['Dataset ID', 'Name', 'Items', 'Size', 'Created', 'Modified'],
@@ -58,7 +58,7 @@ export class DatasetsLsCommand extends ApifyCommand<typeof DatasetsLsCommand> {
 		const { desc, offset, limit, json, unnamed } = this.flags;
 
 		const client = await getLoggedClientOrThrow();
-		const user = await getLocalUserInfo();
+		const user = await getCurrentUserInfo();
 
 		const rawDatasetList = await client.datasets().list({ desc, offset, limit, unnamed });
 
diff --git a/src/commands/info.ts b/src/commands/info.ts
index 63c78402d..51cf5a10c 100644
--- a/src/commands/info.ts
+++ b/src/commands/info.ts
@@ -1,7 +1,8 @@
 import chalk from 'chalk';
 
+import { resolveAuth, TOKEN_SOURCE_LABELS } from '../lib/auth.js';
 import { ApifyCommand } from '../lib/command-framework/apify-command.js';
-import { getLocalUserInfo, getLoggedClientOrThrow } from '../lib/utils.js';
+import { getCurrentUserInfo, getLoggedClientOrThrow } from '../lib/utils.js';
 
 export class InfoCommand extends ApifyCommand<typeof InfoCommand> {
 	static override name = 'info' as const;
@@ -21,17 +22,20 @@ export class InfoCommand extends ApifyCommand<typeof InfoCommand> {
 
 	async run() {
 		await getLoggedClientOrThrow();
-		const info = await getLocalUserInfo();
+		const info = await getCurrentUserInfo();
+		const auth = await resolveAuth();
 
-		if (info) {
-			const niceInfo = {
-				username: info.username,
-				userId: info.id,
-			} as const;
+		const niceInfo: Record<string, string | undefined> = {
+			username: info.username,
+			userId: info.id,
+		};
 
-			for (const key of Object.keys(niceInfo) as (keyof typeof niceInfo)[]) {
-				console.log(`${chalk.gray(key)}: ${chalk.bold(niceInfo[key])}`);
-			}
+		if (auth) {
+			niceInfo['token source'] = TOKEN_SOURCE_LABELS[auth.source];
+		}
+
+		for (const key of Object.keys(niceInfo)) {
+			console.log(`${chalk.gray(key)}: ${chalk.bold(niceInfo[key])}`);
 		}
 	}
 }
diff --git a/src/commands/key-value-stores/ls.ts b/src/commands/key-value-stores/ls.ts
index 880d595af..e516df91d 100644
--- a/src/commands/key-value-stores/ls.ts
+++ b/src/commands/key-value-stores/ls.ts
@@ -5,7 +5,7 @@ import { Flags } from '../../lib/command-framework/flags.js';
 import { prettyPrintBytes } from '../../lib/commands/pretty-print-bytes.js';
 import { CompactMode, ResponsiveTable } from '../../lib/commands/responsive-table.js';
 import { info, simpleLog } from '../../lib/outputs.js';
-import { getLocalUserInfo, getLoggedClientOrThrow, printJsonToStdout, TimestampFormatter } from '../../lib/utils.js';
+import { getCurrentUserInfo, getLoggedClientOrThrow, printJsonToStdout, TimestampFormatter } from '../../lib/utils.js';
 
 const table = new ResponsiveTable({
 	allColumns: ['Store ID', 'Name', 'Size', 'Created', 'Modified'],
@@ -55,7 +55,7 @@ export class KeyValueStoresLsCommand extends ApifyCommand<typeof KeyValueStoresL
 		const { desc, offset, limit, json, unnamed } = this.flags;
 
 		const client = await getLoggedClientOrThrow();
-		const user = await getLocalUserInfo();
+		const user = await getCurrentUserInfo();
 
 		const rawKvsList = await client.keyValueStores().list({ desc, offset, limit, unnamed });
 
diff --git a/src/commands/mcp/install.ts b/src/commands/mcp/install.ts
index f75c65b39..cfea7b224 100644
--- a/src/commands/mcp/install.ts
+++ b/src/commands/mcp/install.ts
@@ -1,5 +1,6 @@
 import process from 'node:process';
 
+import { resolveAuth } from '../../lib/auth.js';
 import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { Args } from '../../lib/command-framework/args.js';
 import { Flags, YesFlag } from '../../lib/command-framework/flags.js';
@@ -7,25 +8,6 @@ import { CommandExitCodes } from '../../lib/consts.js';
 import { clientNeedsToken, getClientHandler, isSupportedClient, SUPPORTED_CLIENTS } from '../../lib/mcp/clients.js';
 import { buildMcpUrl, DEFAULT_MCP_URL } from '../../lib/mcp/url.js';
 import { error } from '../../lib/outputs.js';
-import { getLocalUserInfo } from '../../lib/utils.js';
-
-/**
- * Resolution order: --token flag → APIFY_TOKEN env → stored login.
- * Prints a user-facing error and sets process.exitCode when no token is available.
- */
-async function resolveApifyToken(tokenFlag: string | undefined): Promise<string | null> {
-	if (tokenFlag) return tokenFlag;
-	if (process.env.APIFY_TOKEN) return process.env.APIFY_TOKEN;
-
-	const userInfo = await getLocalUserInfo();
-	if (userInfo.token) return userInfo.token;
-
-	error({
-		message: `You are not logged in to Apify. Run 'apify login' first, or pass --token <api-token>.`,
-	});
-	process.exitCode = CommandExitCodes.MissingAuth;
-	return null;
-}
 
 export class MCPInstallCommand extends ApifyCommand<typeof MCPInstallCommand> {
 	static override name = 'install' as const;
@@ -71,7 +53,7 @@ export class MCPInstallCommand extends ApifyCommand<typeof MCPInstallCommand> {
 		...YesFlag(`Overwrite an existing 'apify' entry without prompting.`),
 		token: Flags.string({
 			char: 't',
-			description: `Apify API token to embed in the config. Defaults to the token from 'apify login'.`,
+			description: `Apify API token to embed in the config. Defaults to APIFY_TOKEN, then the token from 'apify login'.`,
 		}),
 		url: Flags.string({
 			description: 'Apify MCP server URL.',
@@ -96,9 +78,15 @@ export class MCPInstallCommand extends ApifyCommand<typeof MCPInstallCommand> {
 
 		let token = '';
 		if (clientNeedsToken(client)) {
-			const resolved = await resolveApifyToken(tokenFlag);
-			if (!resolved) return;
-			token = resolved;
+			const auth = await resolveAuth(tokenFlag);
+			if (!auth) {
+				error({
+					message: `You are not logged in to Apify. Run 'apify login' first, or pass --token <api-token>.`,
+				});
+				process.exitCode = CommandExitCodes.MissingAuth;
+				return;
+			}
+			token = auth.token;
 		}
 
 		await getClientHandler(client)({ url: buildMcpUrl(baseUrl, tools), token, yes });
diff --git a/src/commands/run.ts b/src/commands/run.ts
index 834813ef3..3eacdf4e9 100644
--- a/src/commands/run.ts
+++ b/src/commands/run.ts
@@ -10,6 +10,7 @@ import { minVersion } from 'semver';
 import { ACTOR_ENV_VARS, APIFY_ENV_VARS } from '@apify/consts';
 import { validateInputSchema, validateInputUsingValidator } from '@apify/input_schema';
 
+import { resolveAuth } from '../lib/auth.js';
 import { ApifyCommand, StdinMode } from '../lib/command-framework/apify-command.js';
 import { Flags } from '../lib/command-framework/flags.js';
 import { getInputOverride } from '../lib/commands/resolve-input.js';
@@ -30,19 +31,21 @@ import { CRAWLEE_INPUT_KEY_ENV, resolveInputKey, TEMP_INPUT_KEY_PREFIX } from '.
 import { getAjvValidator, getDefaultsFromInputSchema, readInputSchema } from '../lib/input_schema.js';
 import { error, info, warning } from '../lib/outputs.js';
 import { replaceSecretsValue } from '../lib/secrets.js';
+import type { AuthJSON } from '../lib/types.js';
 import {
 	Ajv2019,
 	checkIfStorageIsEmpty,
 	getLocalInput,
 	getLocalKeyValueStorePath,
 	getLocalStorageDir,
-	getLocalUserInfo,
+	getCurrentUserInfo,
 	isNodeVersionSupported,
 	isPythonVersionSupported,
 	purgeDefaultDataset,
 	purgeDefaultKeyValueStore,
 	purgeDefaultQueue,
 } from '../lib/utils.js';
+import { cliDebugPrint } from '../lib/utils/cliDebugPrint.js';
 
 interface TempInputResult {
 	tempInputKey: string;
@@ -145,7 +148,13 @@ export class RunCommand extends ApifyCommand<typeof RunCommand> {
 	async run() {
 		const cwd = process.cwd();
 
-		const { proxy, id: userId, token } = await getLocalUserInfo();
+		const auth = await resolveAuth();
+		// An env token has no entry in auth.json, so the user id and proxy password come from the
+		// API. Losing them only costs the child two env vars, so a failed lookup must not stop the run.
+		const { proxy, id: userId } = await getCurrentUserInfo().catch((err) => {
+			cliDebugPrint('[run] could not resolve the account behind the token', { error: err });
+			return {} as AuthJSON;
+		});
 
 		const localConfigResult = await useActorConfig({ cwd });
 
@@ -331,7 +340,7 @@ export class RunCommand extends ApifyCommand<typeof RunCommand> {
 
 		if (proxy && proxy.password) localEnvVars[APIFY_ENV_VARS.PROXY_PASSWORD] = proxy.password;
 		if (userId) localEnvVars[APIFY_ENV_VARS.USER_ID] = userId;
-		if (token) localEnvVars[APIFY_ENV_VARS.TOKEN] = token;
+		if (auth) localEnvVars[APIFY_ENV_VARS.TOKEN] = auth.token;
 		if (localConfig!.environmentVariables) {
 			const updatedEnv = replaceSecretsValue(localConfig!.environmentVariables as Record<string, string>, undefined, {
 				allowMissing: this.flags.allowMissingSecrets,
@@ -342,7 +351,7 @@ export class RunCommand extends ApifyCommand<typeof RunCommand> {
 		// localEnvVars must take priority so the CLI can redirect the SDK to temp input files
 		const env = { ...process.env, ...localEnvVars };
 
-		if (!userId) {
+		if (!auth) {
 			warning({
 				message:
 					'You are not logged in with your Apify Account. Some features like Apify Proxy will not work. Call "apify login" to fix that.',
diff --git a/src/commands/task/publish.ts b/src/commands/task/publish.ts
index bd43ea488..297f49fa3 100644
--- a/src/commands/task/publish.ts
+++ b/src/commands/task/publish.ts
@@ -7,7 +7,7 @@ import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { Args } from '../../lib/command-framework/args.js';
 import { CommandExitCodes } from '../../lib/consts.js';
 import { error, success } from '../../lib/outputs.js';
-import { getLocalUserInfo, getLoggedClientOrThrow } from '../../lib/utils.js';
+import { getCurrentUserInfo, getLoggedClientOrThrow } from '../../lib/utils.js';
 
 export class TaskPublishCommand extends ApifyCommand<typeof TaskPublishCommand> {
 	static override name = 'publish' as const;
@@ -40,7 +40,7 @@ export class TaskPublishCommand extends ApifyCommand<typeof TaskPublishCommand>
 
 	async run() {
 		const apifyClient = await getLoggedClientOrThrow();
-		const userInfo = await getLocalUserInfo();
+		const userInfo = await getCurrentUserInfo();
 		const usernameOrId = userInfo.username || (userInfo.id as string);
 
 		const { taskId } = this.args;
diff --git a/src/commands/task/run.ts b/src/commands/task/run.ts
index e4e9add60..1e6d2055f 100644
--- a/src/commands/task/run.ts
+++ b/src/commands/task/run.ts
@@ -4,7 +4,7 @@ import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { Args } from '../../lib/command-framework/args.js';
 import { runActorOrTaskOnCloud, SharedRunOnCloudFlags } from '../../lib/commands/run-on-cloud.js';
 import { finalizeRun } from '../../lib/commands/run-result.js';
-import { getLocalUserInfo, getLoggedClientOrThrow } from '../../lib/utils.js';
+import { getCurrentUserInfo, getLoggedClientOrThrow } from '../../lib/utils.js';
 
 export class TaskRunCommand extends ApifyCommand<typeof TaskRunCommand> {
 	static override name = 'run' as const;
@@ -39,7 +39,7 @@ export class TaskRunCommand extends ApifyCommand<typeof TaskRunCommand> {
 
 	async run() {
 		const apifyClient = await getLoggedClientOrThrow();
-		const userInfo = await getLocalUserInfo();
+		const userInfo = await getCurrentUserInfo();
 		const usernameOrId = userInfo.username || (userInfo.id as string);
 
 		const { id: taskId, userFriendlyId, title } = await this.resolveTaskId(apifyClient, usernameOrId);
diff --git a/src/commands/task/unpublish.ts b/src/commands/task/unpublish.ts
index 26c2a310e..b272dc60c 100644
--- a/src/commands/task/unpublish.ts
+++ b/src/commands/task/unpublish.ts
@@ -7,7 +7,7 @@ import { ApifyCommand } from '../../lib/command-framework/apify-command.js';
 import { Args } from '../../lib/command-framework/args.js';
 import { CommandExitCodes } from '../../lib/consts.js';
 import { error, success } from '../../lib/outputs.js';
-import { getLocalUserInfo, getLoggedClientOrThrow } from '../../lib/utils.js';
+import { getCurrentUserInfo, getLoggedClientOrThrow } from '../../lib/utils.js';
 
 export class TaskUnpublishCommand extends ApifyCommand<typeof TaskUnpublishCommand> {
 	static override name = 'unpublish' as const;
@@ -39,7 +39,7 @@ export class TaskUnpublishCommand extends ApifyCommand<typeof TaskUnpublishComma
 
 	async run() {
 		const apifyClient = await getLoggedClientOrThrow();
-		const userInfo = await getLocalUserInfo();
+		const userInfo = await getCurrentUserInfo();
 		const usernameOrId = userInfo.username || (userInfo.id as string);
 
 		const { taskId } = this.args;
diff --git a/src/lib/actor.ts b/src/lib/actor.ts
index f0823c2c7..e7f742aae 100644
--- a/src/lib/actor.ts
+++ b/src/lib/actor.ts
@@ -9,7 +9,8 @@ import { ApifyClient } from 'apify-client';
 
 import { ACTOR_ENV_VARS, APIFY_ENV_VARS, KEY_VALUE_STORE_KEYS, LOCAL_ACTOR_ENV_VARS } from '@apify/consts';
 
-import { getApifyClientOptions, getLocalStorageDir, getLocalUserInfo } from './utils.js';
+import { getApifyClientOptions, resolveAuth } from './auth.js';
+import { getLocalStorageDir } from './utils.js';
 
 export const APIFY_STORAGE_TYPES = {
 	KEY_VALUE_STORE: 'KEY_VALUE_STORE',
@@ -17,26 +18,6 @@ export const APIFY_STORAGE_TYPES = {
 	REQUEST_QUEUE: 'REQUEST_QUEUE',
 } as const;
 
-/**
- * Returns Apify token from environment variable or local auth file.
- * @returns Apify token
- */
-export const getApifyTokenFromEnvOrAuthFile = async () => {
-	const apifyToken = process.env[APIFY_ENV_VARS.TOKEN];
-	if (apifyToken) {
-		return apifyToken;
-	}
-
-	const localUserInfo = await getLocalUserInfo();
-	if (!localUserInfo || !localUserInfo.token) {
-		throw new Error(
-			'Apify token is not set. Please set it using the environment variable APIFY_TOKEN or apify login command.',
-		);
-	}
-
-	return localUserInfo.token;
-};
-
 /**
  * Returns instance of ApifyClient or ApifyStorageLocal based on environment variables.
  * @param options - ApifyClient options
@@ -54,10 +35,13 @@ export const getApifyStorageClient = async (
 			...options,
 		});
 	}
-	const apifyToken = await getApifyTokenFromEnvOrAuthFile();
+	const auth = await resolveAuth();
+	if (!auth) {
+		throw new Error(`Apify token is not set. Set ${APIFY_ENV_VARS.TOKEN} or call "apify login".`);
+	}
 
 	return new ApifyClient({
-		...(await getApifyClientOptions(apifyToken)),
+		...(await getApifyClientOptions(auth.token)),
 		...options,
 	});
 };
diff --git a/src/lib/auth.ts b/src/lib/auth.ts
new file mode 100644
index 000000000..3e7c8231d
--- /dev/null
+++ b/src/lib/auth.ts
@@ -0,0 +1,194 @@
+import { existsSync, writeFileSync } from 'node:fs';
+import process from 'node:process';
+
+import { ApifyApiError, ApifyClient, type ApifyClientOptions } from 'apify-client';
+import { AxiosHeaders } from 'axios';
+
+import { APIFY_ENV_VARS } from '@apify/consts';
+
+import { APIFY_CLIENT_DEFAULT_HEADERS, AUTH_FILE_PATH } from './consts.js';
+import { ensureMigrated, getBackend, getToken, setProxyPassword, setToken } from './credentials.js';
+import { ensureApifyDirectory } from './files.js';
+import { warning } from './outputs.js';
+import { cliDebugPrint } from './utils/cliDebugPrint.js';
+
+export type TokenSource = 'flag' | 'env' | 'stored';
+
+export interface ResolvedAuth {
+	token: string;
+	source: TokenSource;
+}
+
+/**
+ * Values that mean the variable was never really set: `APIFY_TOKEN=$UNSET_VAR` leaves an empty
+ * string, and templating an absent value writes the literal "undefined".
+ */
+const PLACEHOLDER_TOKENS = new Set(['undefined', 'null', 'nil', 'none', 'nan', 'false', '0', '-']);
+
+/** The `APIFY_TOKEN` value, or `undefined` when it is unset, blank, or a placeholder. */
+export function getEnvToken(): string | undefined {
+	const raw = process.env[APIFY_ENV_VARS.TOKEN]?.trim();
+	if (!raw || PLACEHOLDER_TOKENS.has(raw.toLowerCase())) return undefined;
+	return raw;
+}
+
+let envNoticeShown = false;
+
+/** Test-only: let each test see the once-per-process notice again. */
+export function __resetAuthNoticesForTests() {
+	envNoticeShown = false;
+}
+
+/**
+ * `resolveAuth` runs several times per command, so the notice is emitted once. Stderr keeps
+ * `auth token` pipeable and `--json` output parseable.
+ */
+function noticeOnce(message: string) {
+	if (envNoticeShown) return;
+	envNoticeShown = true;
+	warning({ message });
+}
+
+/** Where a resolved token came from, for messages that need to name it. */
+export const TOKEN_SOURCE_LABELS: Record<TokenSource, string> = {
+	flag: '--token flag',
+	env: `${APIFY_ENV_VARS.TOKEN} environment variable`,
+	stored: 'apify login',
+};
+
+/**
+ * The single token resolver. Order: a token the command was given -> `APIFY_TOKEN` -> stored
+ * login. Only `login` and `mcp install` take a token of their own; every other command uses
+ * `APIFY_TOKEN` to run as a different account. Inside a platform run there is no stored login,
+ * so `APIFY_TOKEN` wins without a special case for the `actor` entrypoint.
+ *
+ * Read-only by contract. Only `apify login` writes credentials, through {@link loginWithToken}.
+ */
+export const resolveAuth = async (explicitToken?: string): Promise<ResolvedAuth | undefined> => {
+	if (explicitToken) {
+		return { token: explicitToken, source: 'flag' };
+	}
+
+	await ensureMigrated();
+
+	const envToken = getEnvToken();
+	if (envToken) {
+		// Only worth saying when there is a stored login to override. In CI and inside a platform
+		// run APIFY_TOKEN is the only credential, so naming it would be noise on every command.
+		if (existsSync(AUTH_FILE_PATH())) {
+			noticeOnce(`Using the API token from ${APIFY_ENV_VARS.TOKEN}.`);
+		}
+
+		return { token: envToken, source: 'env' };
+	}
+
+	const rawEnvToken = process.env[APIFY_ENV_VARS.TOKEN]?.trim();
+	if (rawEnvToken) {
+		noticeOnce(`${APIFY_ENV_VARS.TOKEN} is invalid: "${rawEnvToken}".`);
+	}
+
+	const storedToken = await getToken();
+	if (storedToken) {
+		return { token: storedToken, source: 'stored' };
+	}
+
+	return undefined;
+};
+
+/**
+ * Message for a token that the API rejected, or for having no token at all. `error` is the
+ * failure the lookup produced, so an unreachable API is not reported as a bad token.
+ */
+export async function describeAuthFailure(error?: unknown): Promise<string> {
+	const auth = await resolveAuth();
+
+	if (!auth) {
+		return 'You are not logged in with your Apify account. Call "apify login" to fix that.';
+	}
+
+	// Only the API can reject a token, so a failure that carries no auth status is something else.
+	const statusCode = error instanceof ApifyApiError ? error.statusCode : undefined;
+	if (error && statusCode !== 401 && statusCode !== 403) {
+		const reason = error instanceof Error ? error.message : String(error);
+		return `Could not verify your API token. The Apify API request failed: ${reason}`;
+	}
+
+	switch (auth.source) {
+		case 'flag':
+			return 'The API token passed with --token was rejected. Check the token and try again.';
+		case 'env':
+			return `The API token in ${APIFY_ENV_VARS.TOKEN} was rejected. Unset it to use your stored login instead.`;
+		default:
+			return 'Your stored API token was rejected. Call "apify login" to log in again.';
+	}
+}
+
+type CJSAxiosHeaders = import('axios', { with: { 'resolution-mode': 'require' } }).AxiosRequestConfig['headers'];
+
+/** Base URL and headers, with no token and so no credential lookup. */
+export const getAnonymousApifyClientOptions = (apiBaseUrl?: string): ApifyClientOptions => ({
+	baseUrl: apiBaseUrl || process.env.APIFY_CLIENT_BASE_URL,
+	requestInterceptors: [
+		(config) => {
+			config.headers ??= new AxiosHeaders() as CJSAxiosHeaders;
+
+			for (const [key, value] of Object.entries(APIFY_CLIENT_DEFAULT_HEADERS)) {
+				config.headers![key] = value;
+			}
+
+			return config;
+		},
+	],
+});
+
+/**
+ * Returns options for ApifyClient
+ */
+export const getApifyClientOptions = async (token?: string, apiBaseUrl?: string): Promise<ApifyClientOptions> => ({
+	...getAnonymousApifyClientOptions(apiBaseUrl),
+	token: (await resolveAuth(token))?.token,
+});
+
+/**
+ * Authenticates `token` and saves it together with the account metadata. This is the only
+ * credential writer in the CLI — every other code path resolves tokens without persisting them.
+ *
+ * Returns `null` when the token is rejected, in which case nothing is written.
+ */
+export async function loginWithToken(token: string, apiBaseUrl?: string): Promise<ApifyClient | null> {
+	const apifyClient = new ApifyClient(await getApifyClientOptions(token, apiBaseUrl));
+
+	let userInfo;
+	try {
+		userInfo = await apifyClient.user('me').get();
+	} catch (err) {
+		cliDebugPrint('[loginWithToken] error getting user info', { error: err, apiBaseUrl });
+		return null;
+	}
+
+	// Replaces the previous account rather than merging into it, so fields the new account
+	// does not have (email, organizationOwnerUserId) cannot linger from the old one.
+	const fileContents: Record<string, unknown> = { ...userInfo, secretsBackend: await getBackend() };
+	if (fileContents.proxy && typeof fileContents.proxy === 'object') {
+		const { password: _password, ...rest } = fileContents.proxy as { password?: string };
+		if (Object.keys(rest).length > 0) {
+			fileContents.proxy = rest;
+		} else {
+			delete fileContents.proxy;
+		}
+	}
+
+	ensureApifyDirectory(AUTH_FILE_PATH());
+	writeFileSync(AUTH_FILE_PATH(), JSON.stringify(fileContents, null, '\t'), { mode: 0o600 });
+
+	// Written after the metadata file, which would otherwise clobber them on the file backend.
+	// `skipIfUnchanged` avoids a macOS Keychain prompt when the value already matches.
+	await setToken(token, { skipIfUnchanged: true });
+
+	const proxyPassword = userInfo.proxy?.password;
+	if (proxyPassword) {
+		await setProxyPassword(proxyPassword, { skipIfUnchanged: true });
+	}
+
+	return apifyClient;
+}
diff --git a/src/lib/commands/resolve-actor-context.ts b/src/lib/commands/resolve-actor-context.ts
index 22d45e34a..bc0ed27c7 100644
--- a/src/lib/commands/resolve-actor-context.ts
+++ b/src/lib/commands/resolve-actor-context.ts
@@ -2,7 +2,7 @@ import process from 'node:process';
 
 import type { ApifyClient } from 'apify-client';
 
-import { getLocalConfig, getLocalUserInfo } from '../utils.js';
+import { getLocalConfig, getCurrentUserInfo } from '../utils.js';
 
 /**
  * Tries to resolve what actor the command ran points to. If an actor id is provided via command line, attempt to resolve it,
@@ -17,7 +17,7 @@ export async function resolveActorContext({
 	providedActorNameOrId: string | undefined;
 	client: ApifyClient;
 }) {
-	const userInfo = await getLocalUserInfo();
+	const userInfo = await getCurrentUserInfo();
 	const usernameOrId = userInfo.username || (userInfo.id as string);
 	const localConfig = getLocalConfig(process.cwd()) || {};
 
diff --git a/src/lib/commands/storages.ts b/src/lib/commands/storages.ts
index f3d043de3..1fbd6cdc7 100644
--- a/src/lib/commands/storages.ts
+++ b/src/lib/commands/storages.ts
@@ -1,6 +1,6 @@
 import type { ApifyClient, Dataset, DatasetClient, KeyValueStore, KeyValueStoreClient } from 'apify-client';
 
-import { getLocalUserInfo } from '../utils.js';
+import { getCurrentUserInfo } from '../utils.js';
 
 type ReturnTypeForStorage<T extends 'dataset' | 'keyValueStore'> = T extends 'dataset'
 	? {
@@ -25,7 +25,7 @@ async function tryToGetStorage<T extends 'dataset' | 'keyValueStore'>(
 		} as ReturnTypeForStorage<T>;
 	}
 
-	const info = await getLocalUserInfo();
+	const info = await getCurrentUserInfo();
 
 	const byName = await client[storageType](`${info.username!}/${id}`)
 		.get()
diff --git a/src/lib/utils.ts b/src/lib/utils.ts
index 73502f9be..87ed7e037 100644
--- a/src/lib/utils.ts
+++ b/src/lib/utils.ts
@@ -9,9 +9,9 @@ import { DurationFormatter as SapphireDurationFormatter, TimeTypes } from '@sapp
 import { Timestamp } from '@sapphire/timestamp';
 import AdmZip from 'adm-zip';
 import _Ajv2019 from 'ajv/dist/2019.js';
-import { type ActorRun, ApifyClient, type ApifyClientOptions, type Build } from 'apify-client';
+import { type ActorRun, ApifyClient, type Build } from 'apify-client';
 import { ZipArchive } from 'archiver';
-import axios, { AxiosHeaders } from 'axios';
+import axios from 'axios';
 import escapeStringRegexp from 'escape-string-regexp';
 import ignoreModule, { type Ignore } from 'ignore';
 import { getEncoding } from 'istextorbinary';
@@ -32,8 +32,8 @@ import {
 	SOURCE_FILE_FORMATS,
 } from '@apify/consts';
 
+import { describeAuthFailure, getApifyClientOptions, resolveAuth } from './auth.js';
 import {
-	APIFY_CLIENT_DEFAULT_HEADERS,
 	AUTH_FILE_PATH,
 	CommandExitCodes,
 	DEFAULT_LOCAL_STORAGE_DIR,
@@ -41,8 +41,8 @@ import {
 	MINIMUM_SUPPORTED_PYTHON_VERSION,
 	SUPPORTED_NODEJS_VERSION,
 } from './consts.js';
-import { ensureMigrated, getBackend, getProxyPassword, getToken, setProxyPassword, setToken } from './credentials.js';
-import { deleteFile, ensureApifyDirectory, ensureFolderExistsSync, rimrafPromised } from './files.js';
+import { ensureMigrated, getBackend, getProxyPassword, getToken } from './credentials.js';
+import { deleteFile, ensureFolderExistsSync, rimrafPromised } from './files.js';
 import { useCLIMetadata } from './hooks/useCLIMetadata.js';
 import { inputFileRegExp, TEMP_INPUT_KEY_PREFIX } from './input-key.js';
 import type { AuthJSON } from './types.js';
@@ -120,98 +120,67 @@ export const getLocalUserInfo = async (): Promise<AuthJSON> => {
  * Gets instance of ApifyClient for user otherwise throws error
  */
 export async function getLoggedClientOrThrow() {
-	const loggedClient = await getLoggedClient();
+	const { client, error } = await getLoggedClient();
 
-	if (!loggedClient) {
+	if (!client) {
 		process.exitCode = CommandExitCodes.MissingAuth;
-		throw new Error('You are not logged in with your Apify account. Call "apify login" to fix that.');
+		throw new Error(await describeAuthFailure(error));
 	}
-	return loggedClient;
+	return client;
 }
 
-const resolveToken = async (existingToken?: string): Promise<string | undefined> => {
-	if (existingToken) return existingToken;
-	await ensureMigrated();
-	return getToken();
-};
-
-type CJSAxiosHeaders = import('axios', { with: { 'resolution-mode': 'require' } }).AxiosRequestConfig['headers'];
-
-/**
- * Returns options for ApifyClient
- */
-export const getApifyClientOptions = async (token?: string, apiBaseUrl?: string): Promise<ApifyClientOptions> => {
-	const resolvedToken = await resolveToken(token);
-
-	return {
-		token: resolvedToken,
-		baseUrl: apiBaseUrl || process.env.APIFY_CLIENT_BASE_URL,
-		requestInterceptors: [
-			(config) => {
-				config.headers ??= new AxiosHeaders() as CJSAxiosHeaders;
-
-				for (const [key, value] of Object.entries(APIFY_CLIENT_DEFAULT_HEADERS)) {
-					config.headers![key] = value;
-				}
+let cachedUserInfo: { token: string; userInfo: AuthJSON } | undefined;
 
-				return config;
-			},
-		],
-	};
-};
+/** Test-only: drop the in-memory account metadata so each test starts fresh. */
+export function __resetUserInfoCacheForTests() {
+	cachedUserInfo = undefined;
+}
 
 /**
- * Gets instance of ApifyClient for token or for params from global auth file.
+ * `client` is `null` when no token is available or the lookup failed; `error` carries that
+ * failure, so the caller can tell a rejected token from an API it could not reach.
  *
- * Refreshes the user metadata in auth.json each run. Secrets (token, proxy.password) only
- * get written when their value actually changes — avoids macOS Keychain prompts on every command.
+ * Read-only: the resolved token is never persisted.
  */
-export async function getLoggedClient(token?: string, apiBaseUrl?: string) {
-	const resolvedToken = await resolveToken(token);
+async function getLoggedClient(): Promise<{ client: ApifyClient | null; error?: unknown }> {
+	const auth = await resolveAuth();
+	if (!auth) return { client: null };
 
-	const apifyClient = new ApifyClient(await getApifyClientOptions(resolvedToken, apiBaseUrl));
+	const apifyClient = new ApifyClient(await getApifyClientOptions(auth.token));
 
-	let userInfo;
 	try {
-		userInfo = await apifyClient.user('me').get();
+		const userInfo = (await apifyClient.user('me').get()) as AuthJSON;
+		cachedUserInfo = { token: auth.token, userInfo };
 	} catch (err) {
-		cliDebugPrint('[getLoggedClient] error getting user info', { error: err, apiBaseUrl });
-		return null;
+		cliDebugPrint('[getLoggedClient] error getting user info', { error: err });
+		return { client: null, error: err };
 	}
 
-	if (apifyClient.token) {
-		await setToken(apifyClient.token, { skipIfUnchanged: true });
-	}
+	return { client: apifyClient };
+}
 
-	const proxyPassword = userInfo.proxy?.password;
-	if (proxyPassword) {
-		await setProxyPassword(proxyPassword, { skipIfUnchanged: true });
-	}
+/**
+ * Account metadata for the token the current command resolved, preferring what
+ * {@link getLoggedClient} already fetched. An env token has no entry in auth.json, so a cold
+ * cache means an API call — bounded, because `apify run` reaches here before spawning anything
+ * and the client would otherwise retry an unreachable API for minutes.
+ */
+export async function getCurrentUserInfo(): Promise<AuthJSON> {
+	const auth = await resolveAuth();
+	if (!auth) return getLocalUserInfo();
 
-	ensureApifyDirectory(AUTH_FILE_PATH());
-	const existingFile = (() => {
-		try {
-			return JSON.parse(readFileSync(AUTH_FILE_PATH(), 'utf-8')) as Record<string, unknown>;
-		} catch {
-			return {};
-		}
-	})();
-	const backend = await getBackend();
-	const fileContents: Record<string, unknown> = { ...existingFile, ...userInfo, secretsBackend: backend };
-	if (backend === 'keyring') {
-		delete fileContents.token;
-		if (fileContents.proxy && typeof fileContents.proxy === 'object') {
-			const { password: _password, ...rest } = fileContents.proxy as { password?: string };
-			if (Object.keys(rest).length > 0) {
-				fileContents.proxy = rest;
-			} else {
-				delete fileContents.proxy;
-			}
-		}
-	}
-	writeFileSync(AUTH_FILE_PATH(), JSON.stringify(fileContents, null, '\t'), { mode: 0o600 });
+	if (cachedUserInfo?.token === auth.token) return cachedUserInfo.userInfo;
+	if (auth.source === 'stored') return getLocalUserInfo();
+
+	const apifyClient = new ApifyClient({
+		...(await getApifyClientOptions(auth.token)),
+		maxRetries: 1,
+		timeoutSecs: 10,
+	});
+	const userInfo = (await apifyClient.user('me').get()) as AuthJSON;
+	cachedUserInfo = { token: auth.token, userInfo };
 
-	return apifyClient;
+	return userInfo;
 }
 
 export const getLocalConfigPath = (cwd: string) => join(cwd, LOCAL_CONFIG_PATH);
diff --git a/test/__setup__/config.ts b/test/__setup__/config.ts
index 3a62b6eeb..f0420ff5a 100644
--- a/test/__setup__/config.ts
+++ b/test/__setup__/config.ts
@@ -3,7 +3,7 @@ import { EOL } from 'node:os';
 import { ApifyClient } from 'apify-client';
 import { isCI } from 'ci-info';
 
-import { getApifyClientOptions } from '../../src/lib/utils.js';
+import { getApifyClientOptions } from '../../src/lib/auth.js';
 
 const { TEST_USER_TOKEN: ENV_TEST_USER_TOKEN } = process.env;
 
diff --git a/test/__setup__/hooks/useAuthSetup.ts b/test/__setup__/hooks/useAuthSetup.ts
index aa0ae48e4..5fefdbe00 100644
--- a/test/__setup__/hooks/useAuthSetup.ts
+++ b/test/__setup__/hooks/useAuthSetup.ts
@@ -6,10 +6,11 @@ import { isCI } from 'ci-info';
 import { cryptoRandomObjectId } from '@apify/utilities';
 
 import { LoginCommand } from '../../../src/commands/login.js';
+import { __resetAuthNoticesForTests } from '../../../src/lib/auth.js';
 import { testRunCommand } from '../../../src/lib/command-framework/apify-command.js';
 import { GLOBAL_CONFIGS_FOLDER } from '../../../src/lib/consts.js';
 import { __resetCredentialsForTests } from '../../../src/lib/credentials.js';
-import { getLocalUserInfo } from '../../../src/lib/utils.js';
+import { __resetUserInfoCacheForTests, getLocalUserInfo } from '../../../src/lib/utils.js';
 
 export interface UseAuthSetupOptions {
 	/**
@@ -43,7 +44,11 @@ export function useAuthSetup({ cleanup = true, perTest = true }: UseAuthSetupOpt
 		// Tests pin to the file backend so they don't touch the real OS keyring.
 		// Unit tests for credentials.ts override this explicitly.
 		vitest.stubEnv('APIFY_DISABLE_KEYRING', '1');
+		// The resolver reads APIFY_TOKEN, so a token in the developer's shell would leak into tests.
+		vitest.stubEnv('APIFY_TOKEN', '');
 		__resetCredentialsForTests();
+		__resetUserInfoCacheForTests();
+		__resetAuthNoticesForTests();
 	});
 
 	after(async () => {
@@ -52,6 +57,8 @@ export function useAuthSetup({ cleanup = true, perTest = true }: UseAuthSetupOpt
 		}
 
 		__resetCredentialsForTests();
+		__resetUserInfoCacheForTests();
+		__resetAuthNoticesForTests();
 		vitest.unstubAllEnvs();
 	});
 }
@@ -71,6 +78,8 @@ export function useKeyringBackend() {
 
 		vitest.stubEnv('APIFY_DISABLE_KEYRING', '');
 		__resetCredentialsForTests();
+		__resetUserInfoCacheForTests();
+		__resetAuthNoticesForTests();
 	});
 }
 
diff --git a/test/e2e/__helpers__/run-cli.ts b/test/e2e/__helpers__/run-cli.ts
index 99cfae9f9..3915832f8 100644
--- a/test/e2e/__helpers__/run-cli.ts
+++ b/test/e2e/__helpers__/run-cli.ts
@@ -53,6 +53,8 @@ export async function runCli(
 			APIFY_CLI_SKIP_RENTAL_SUNSET_NOTICE: '1',
 			// Pin the file backend so e2e subprocesses don't share the host's OS keyring across tests.
 			APIFY_DISABLE_KEYRING: '1',
+			// The resolver prefers APIFY_TOKEN, so a token on the host would pick the account.
+			APIFY_TOKEN: '',
 			...options.env,
 		},
 	});
diff --git a/test/e2e/commands/builds/lifecycle.test.ts b/test/e2e/commands/builds/lifecycle.test.ts
index 29e9c5644..154b4ec1b 100644
--- a/test/e2e/commands/builds/lifecycle.test.ts
+++ b/test/e2e/commands/builds/lifecycle.test.ts
@@ -2,7 +2,7 @@ import { randomBytes } from 'node:crypto';
 
 import { ApifyClient } from 'apify-client';
 
-import { getApifyClientOptions } from '../../../../src/lib/utils.js';
+import { getApifyClientOptions } from '../../../../src/lib/auth.js';
 import { runCli } from '../../__helpers__/run-cli.js';
 import { createTestActor, removeTestActor, type TestActor } from '../../__helpers__/test-actor.js';
 
diff --git a/test/e2e/commands/datasets/lifecycle.test.ts b/test/e2e/commands/datasets/lifecycle.test.ts
index b0b2deecf..656c0b754 100644
--- a/test/e2e/commands/datasets/lifecycle.test.ts
+++ b/test/e2e/commands/datasets/lifecycle.test.ts
@@ -2,7 +2,7 @@ import { randomBytes } from 'node:crypto';
 
 import { ApifyClient } from 'apify-client';
 
-import { getApifyClientOptions } from '../../../../src/lib/utils.js';
+import { getApifyClientOptions } from '../../../../src/lib/auth.js';
 import { runCli } from '../../__helpers__/run-cli.js';
 
 describe('[e2e][api] datasets namespace', () => {
diff --git a/test/e2e/commands/key-value-stores/lifecycle.test.ts b/test/e2e/commands/key-value-stores/lifecycle.test.ts
index f01399a4b..0c477243c 100644
--- a/test/e2e/commands/key-value-stores/lifecycle.test.ts
+++ b/test/e2e/commands/key-value-stores/lifecycle.test.ts
@@ -2,7 +2,7 @@ import { randomBytes } from 'node:crypto';
 
 import { ApifyClient } from 'apify-client';
 
-import { getApifyClientOptions } from '../../../../src/lib/utils.js';
+import { getApifyClientOptions } from '../../../../src/lib/auth.js';
 import { runCli } from '../../__helpers__/run-cli.js';
 
 describe('[e2e][api] key-value-stores namespace', () => {
diff --git a/test/e2e/commands/runs/lifecycle.test.ts b/test/e2e/commands/runs/lifecycle.test.ts
index aa99a05ad..cb2ff4a21 100644
--- a/test/e2e/commands/runs/lifecycle.test.ts
+++ b/test/e2e/commands/runs/lifecycle.test.ts
@@ -4,7 +4,7 @@ import path from 'node:path';
 
 import { ApifyClient } from 'apify-client';
 
-import { getApifyClientOptions } from '../../../../src/lib/utils.js';
+import { getApifyClientOptions } from '../../../../src/lib/auth.js';
 import { runCli } from '../../__helpers__/run-cli.js';
 import { createTestActor, removeTestActor, type TestActor } from '../../__helpers__/test-actor.js';
 import { TestTmpRoot } from '../../__helpers__/tmp.js';
diff --git a/test/local/commands/auth.test.ts b/test/local/commands/auth.test.ts
index 43a012881..ecf6b4d51 100644
--- a/test/local/commands/auth.test.ts
+++ b/test/local/commands/auth.test.ts
@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import process from 'node:process';
 
-import { AUTH_FILE_PATH } from '../../../src/lib/consts.js';
+import { AUTH_FILE_PATH, CommandExitCodes } from '../../../src/lib/consts.js';
 import { getToken } from '../../../src/lib/credentials.js';
 import { useAuthSetup, useKeyringBackend } from '../../__setup__/hooks/useAuthSetup.js';
 import { useConsoleSpy } from '../../__setup__/hooks/useConsoleSpy.js';
@@ -113,16 +113,71 @@ describe('auth commands', () => {
 
 			const authFile = readAuthFile();
 			expect(authFile).toMatchObject({ token: 'apify_api_other_token', id: 'uid2', username: 'other' });
-			// Known gap: getLoggedClient merges, so the old account's extra fields survive.
-			expect(authFile.email).toBe('me@example.com');
+			// The new account has no email, so the old one must not linger.
+			expect(authFile.email).toBeUndefined();
 		});
 
-		it('login with an invalid token stores nothing', async () => {
+		it('login with an invalid token stores nothing and fails the command', async () => {
 			clientState.fail = true;
 			await login('bad-token');
 
 			expect(lastErrorMessage()).toContain('Login to Apify failed');
 			expect(existsSync(AUTH_FILE_PATH())).toBe(false);
+			// A login that exits 0 lets `apify login --token $BAD && apify push` run on.
+			expect(process.exitCode).toBe(CommandExitCodes.MissingAuth);
+			process.exitCode = 0;
+		});
+
+		it('login saves its own token even when APIFY_TOKEN is set, and says it is overridden', async () => {
+			vitest.stubEnv('APIFY_TOKEN', 'apify_api_env_token');
+			await login();
+
+			expect(await getToken()).toBe(TOKEN);
+			expect(lastErrorMessage()).toContain('APIFY_TOKEN is set, so other commands keep using that token');
+		});
+
+		it('login says nothing about APIFY_TOKEN when it is not set', async () => {
+			await login();
+
+			expect(lastErrorMessage()).not.toContain('APIFY_TOKEN');
+		});
+
+		it('logout warns that APIFY_TOKEN still authenticates', async () => {
+			await login();
+			vitest.stubEnv('APIFY_TOKEN', 'apify_api_env_token');
+
+			await testRunCommand(AuthLogoutCommand, {});
+
+			expect(existsSync(AUTH_FILE_PATH())).toBe(false);
+			expect(lastErrorMessage()).toContain('APIFY_TOKEN is still set');
+		});
+
+		it('logout says nothing about APIFY_TOKEN when it is not set', async () => {
+			await login();
+
+			await testRunCommand(AuthLogoutCommand, {});
+
+			expect(lastErrorMessage()).not.toContain('APIFY_TOKEN');
+		});
+
+		it('a placeholder APIFY_TOKEN falls back to the stored login', async () => {
+			await login();
+			vitest.stubEnv('APIFY_TOKEN', 'undefined');
+
+			await testRunCommand(AuthTokenCommand, {});
+
+			expect(lastLogMessage()).toBe(TOKEN);
+		});
+
+		it('auth token prints APIFY_TOKEN over the stored token, and stores nothing', async () => {
+			await login();
+			vitest.stubEnv('APIFY_TOKEN', 'apify_api_env_token');
+
+			await testRunCommand(AuthTokenCommand, {});
+
+			expect(lastLogMessage()).toBe('apify_api_env_token');
+			expect(await getToken()).toBe(TOKEN);
+			expect(readAuthFile()).toMatchObject({ username: 'me' });
 		});
 	});
 
diff --git a/test/local/commands/create-git-source.test.ts b/test/local/commands/create-git-source.test.ts
index 8859fc227..8bf1f9bb5 100644
--- a/test/local/commands/create-git-source.test.ts
+++ b/test/local/commands/create-git-source.test.ts
@@ -70,9 +70,11 @@ vitest.mock('../../../src/lib/git-source/gitSource.js', async (importOriginal) =
 }));
 
 // A Git source needs a token; the mocked flow never uses the client, so an empty one is enough.
+// The account needs stubbing too, or the lookup hits the API with whatever token the host has.
 vitest.mock('../../../src/lib/utils.js', async (importOriginal) => ({
 	...(await importOriginal<typeof import('../../../src/lib/utils.js')>()),
 	getLoggedClientOrThrow: vitest.fn(async () => ({})),
+	getCurrentUserInfo: vitest.fn(async () => ({ id: 'userId', username: 'user' })),
 }));
 
 const actName = 'create-git-source-actor';
diff --git a/test/local/commands/push-git-source.test.ts b/test/local/commands/push-git-source.test.ts
index d56a60ec8..bc96a1dcd 100644
--- a/test/local/commands/push-git-source.test.ts
+++ b/test/local/commands/push-git-source.test.ts
@@ -34,7 +34,7 @@ const versionUpdate = vitest.fn(async () => ({}));
 // Stands in for the platform: the Actor exists, and the version's source type is what is under test.
 vitest.mock('../../../src/lib/utils.js', async (importOriginal) => ({
 	...(await importOriginal<typeof import('../../../src/lib/utils.js')>()),
-	getLocalUserInfo: vitest.fn(async () => ({ id: 'userId', username: 'user' })),
+	getCurrentUserInfo: vitest.fn(async () => ({ id: 'userId', username: 'user' })),
 	outputJobLog: vitest.fn(async () => {}),
 	getLoggedClientOrThrow: vitest.fn(async () => ({
 		baseUrl: 'https://api.apify.com/v2',
diff --git a/test/local/lib/auth.test.ts b/test/local/lib/auth.test.ts
new file mode 100644
index 000000000..e93560140
--- /dev/null
+++ b/test/local/lib/auth.test.ts
@@ -0,0 +1,275 @@
+import { existsSync, readFileSync } from 'node:fs';
+
+import { ApifyApiError } from 'apify-client';
+
+import { loginWithToken, resolveAuth } from '../../../src/lib/auth.js';
+import { AUTH_FILE_PATH } from '../../../src/lib/consts.js';
+import { getProxyPassword, getToken, setToken } from '../../../src/lib/credentials.js';
+import { getCurrentUserInfo, getLoggedClientOrThrow } from '../../../src/lib/utils.js';
+import { useAuthSetup } from '../../__setup__/hooks/useAuthSetup.js';
+import { useConsoleSpy } from '../../__setup__/hooks/useConsoleSpy.js';
+
+const { clientState } = vi.hoisted(() => ({
+	clientState: {
+		user: {} as Record<string, unknown>,
+		fail: false,
+		failWith: undefined as unknown,
+	},
+}));
+
+// Stubbing the client is what lets the auth flow run in test:local.
+vi.mock('apify-client', async (importOriginal) => {
+	const actual = await importOriginal<typeof import('apify-client')>();
+
+	class FakeApifyClient {
+		token?: string;
+
+		constructor(options: { token?: string }) {
+			this.token = options.token;
+		}
+
+		user() {
+			return {
+				get: async () => {
+					if (clientState.fail) throw clientState.failWith ?? new Error('401');
+					return clientState.user;
+				},
+			};
+		}
+	}
+
+	return { ...actual, ApifyClient: FakeApifyClient };
+});
+
+useAuthSetup();
+const { lastErrorMessage, logMessages } = useConsoleSpy();
+
+const STORED = 'apify_api_stored';
+const ENV = 'apify_api_env';
+const FLAG = 'apify_api_flag';
+
+const readAuthFile = () => JSON.parse(readFileSync(AUTH_FILE_PATH(), 'utf-8'));
+
+// A real ApifyApiError, not a look-alike: describeAuthFailure narrows on the class, so a
+// hand-built error would let the 401/403 branch rot without failing a test.
+const apiError = (statusCode: number) =>
+	new ApifyApiError(
+		{ status: statusCode, data: { error: { message: 'nope' } }, config: {}, headers: {}, statusText: '' } as never,
+		1,
+	);
+
+describe('auth', () => {
+	beforeEach(() => {
+		clientState.fail = false;
+		clientState.failWith = undefined;
+		clientState.user = { id: 'uid', username: 'me', proxy: { password: 'pw' } };
+	});
+
+	describe('resolveAuth()', () => {
+		it('returns undefined when no token is available', async () => {
+			await expect(resolveAuth()).resolves.toBeUndefined();
+		});
+
+		it('resolves the stored login when nothing overrides it', async () => {
+			await loginWithToken(STORED);
+
+			await expect(resolveAuth()).resolves.toEqual({ token: STORED, source: 'stored' });
+		});
+
+		it('prefers APIFY_TOKEN over the stored login', async () => {
+			await loginWithToken(STORED);
+			vitest.stubEnv('APIFY_TOKEN', ENV);
+
+			await expect(resolveAuth()).resolves.toEqual({ token: ENV, source: 'env' });
+		});
+
+		it('prefers a token the command was given over APIFY_TOKEN and the stored login', async () => {
+			await loginWithToken(STORED);
+			vitest.stubEnv('APIFY_TOKEN', ENV);
+
+			await expect(resolveAuth(FLAG)).resolves.toEqual({ token: FLAG, source: 'flag' });
+		});
+
+		it.each(['undefined', 'null', 'NaN', 'none', '0', '  '])(
+			'ignores APIFY_TOKEN set to the placeholder %j and uses the stored login',
+			async (placeholder) => {
+				await loginWithToken(STORED);
+				vitest.stubEnv('APIFY_TOKEN', placeholder);
+
+				await expect(resolveAuth()).resolves.toEqual({ token: STORED, source: 'stored' });
+			},
+		);
+
+		it('says so when it falls back from a placeholder APIFY_TOKEN', async () => {
+			await loginWithToken(STORED);
+			vitest.stubEnv('APIFY_TOKEN', 'undefined');
+
+			await resolveAuth();
+
+			expect(lastErrorMessage()).toContain('APIFY_TOKEN is invalid: "undefined"');
+		});
+
+		it('trims surrounding whitespace off APIFY_TOKEN', async () => {
+			vitest.stubEnv('APIFY_TOKEN', `  ${ENV}  `);
+
+			await expect(resolveAuth()).resolves.toEqual({ token: ENV, source: 'env' });
+		});
+
+		it('says so when APIFY_TOKEN overrides a stored login', async () => {
+			await loginWithToken(STORED);
+			vitest.stubEnv('APIFY_TOKEN', ENV);
+
+			await resolveAuth();
+
+			expect(lastErrorMessage()).toContain('Using the API token from APIFY_TOKEN.');
+		});
+
+		it('says nothing when APIFY_TOKEN is the only credential', async () => {
+			vitest.stubEnv('APIFY_TOKEN', ENV);
+
+			await resolveAuth();
+
+			expect(lastErrorMessage()).toBeUndefined();
+		});
+
+		it('says it once even though the resolver runs several times per command', async () => {
+			await loginWithToken(STORED);
+			vitest.stubEnv('APIFY_TOKEN', ENV);
+
+			await resolveAuth();
+			await resolveAuth();
+			await resolveAuth();
+
+			expect(logMessages.error.filter((message) => message.includes('Using the API token'))).toHaveLength(1);
+		});
+
+		it('resolves APIFY_TOKEN with no stored login, as inside a platform run', async () => {
+			vitest.stubEnv('APIFY_TOKEN', ENV);
+
+			await expect(resolveAuth()).resolves.toEqual({ token: ENV, source: 'env' });
+			expect(existsSync(AUTH_FILE_PATH())).toBe(false);
+		});
+	});
+
+	describe('loginWithToken()', () => {
+		it('saves the token, the proxy password and the account metadata', async () => {
+			await loginWithToken(STORED);
+
+			expect(await getToken()).toBe(STORED);
+			expect(await getProxyPassword()).toBe('pw');
+			expect(readAuthFile()).toMatchObject({ id: 'uid', username: 'me' });
+		});
+
+		it('writes nothing when the API rejects the token', async () => {
+			clientState.fail = true;
+
+			await expect(loginWithToken(STORED)).resolves.toBeNull();
+			expect(existsSync(AUTH_FILE_PATH())).toBe(false);
+		});
+
+		it('ignores APIFY_TOKEN and saves the token it was given', async () => {
+			vitest.stubEnv('APIFY_TOKEN', ENV);
+
+			await loginWithToken(STORED);
+
+			expect(await getToken()).toBe(STORED);
+		});
+	});
+
+	describe('getLoggedClientOrThrow()', () => {
+		afterEach(() => {
+			// The command framework reads this; leaving it set would fail the vitest run.
+			process.exitCode = 0;
+		});
+
+		it('reports not being logged in when no token resolves', async () => {
+			await expect(getLoggedClientOrThrow()).rejects.toThrow('You are not logged in');
+		});
+
+		it('names APIFY_TOKEN as the source of a rejected token', async () => {
+			await loginWithToken(STORED);
+			vitest.stubEnv('APIFY_TOKEN', ENV);
+			clientState.fail = true;
+			clientState.failWith = apiError(401);
+
+			await expect(getLoggedClientOrThrow()).rejects.toThrow(`The API token in APIFY_TOKEN was rejected`);
+		});
+
+		it('names the stored login as the source of a rejected token', async () => {
+			await loginWithToken(STORED);
+			clientState.fail = true;
+			clientState.failWith = apiError(403);
+
+			await expect(getLoggedClientOrThrow()).rejects.toThrow('Your stored API token was rejected');
+		});
+
+		it('does not blame the token when the API request itself failed', async () => {
+			await loginWithToken(STORED);
+			clientState.fail = true;
+			clientState.failWith = new Error('getaddrinfo ENOTFOUND api.apify.com');
+
+			await expect(getLoggedClientOrThrow()).rejects.toThrow('The Apify API request failed');
+		});
+	});
+
+	describe('getCurrentUserInfo()', () => {
+		it('reads auth.json for a stored token, without touching the API', async () => {
+			await loginWithToken(STORED);
+			clientState.fail = true;
+
+			await expect(getCurrentUserInfo()).resolves.toMatchObject({ username: 'me', id: 'uid' });
+		});
+
+		it('fetches the account behind APIFY_TOKEN rather than the stored one', async () => {
+			await loginWithToken(STORED);
+			vitest.stubEnv('APIFY_TOKEN', ENV);
+			clientState.user = { id: 'uid2', username: 'other' };
+
+			await expect(getCurrentUserInfo()).resolves.toMatchObject({ username: 'other', id: 'uid2' });
+		});
+
+		it('reuses the account the client lookup already fetched', async () => {
+			await loginWithToken(STORED);
+			vitest.stubEnv('APIFY_TOKEN', ENV);
+			clientState.user = { id: 'uid2', username: 'other' };
+			await getLoggedClientOrThrow();
+
+			// A second API call would throw here; the cache is what keeps this green.
+			clientState.fail = true;
+
+			await expect(getCurrentUserInfo()).resolves.toMatchObject({ username: 'other' });
+		});
+
+		it('prefers that cache over auth.json on the stored path, so a rename is picked up', async () => {
+			await loginWithToken(STORED);
+			clientState.user = { id: 'uid', username: 'renamed' };
+			await getLoggedClientOrThrow();
+
+			await expect(getCurrentUserInfo()).resolves.toMatchObject({ username: 'renamed' });
+		});
+
+		it('returns an empty account when no token resolves', async () => {
+			await expect(getCurrentUserInfo()).resolves.toEqual({});
+		});
+	});
+
+	describe('read paths do not persist', () => {
+		it('resolving APIFY_TOKEN leaves the stored login untouched', async () => {
+			await loginWithToken(STORED);
+			vitest.stubEnv('APIFY_TOKEN', ENV);
+
+			await resolveAuth();
+
+			expect(await getToken()).toBe(STORED);
+			expect(readAuthFile()).toMatchObject({ username: 'me' });
+		});
+
+		it('resolving a token the command was given leaves the stored login untouched', async () => {
+			await setToken(STORED);
+
+			await resolveAuth(FLAG);
+
+			expect(await getToken()).toBe(STORED);
+		});
+	});
+});
diff --git a/test/local/lib/credentials.test.ts b/test/local/lib/credentials.test.ts
index d11d0f111..15c0b8c16 100644
--- a/test/local/lib/credentials.test.ts
+++ b/test/local/lib/credentials.test.ts
@@ -4,6 +4,7 @@ import process from 'node:process';
 
 import { cryptoRandomObjectId } from '@apify/utilities';
 
+import { getApifyClientOptions } from '../../../src/lib/auth.js';
 import { AUTH_FILE_PATH, GLOBAL_CONFIGS_FOLDER } from '../../../src/lib/consts.js';
 import {
 	__resetCredentialsForTests,
@@ -15,7 +16,7 @@ import {
 	setProxyPassword,
 	setToken,
 } from '../../../src/lib/credentials.js';
-import { getApifyClientOptions, getLocalUserInfo } from '../../../src/lib/utils.js';
+import { getLocalUserInfo } from '../../../src/lib/utils.js';
 import {
 	KEYRING_PROXY_PASSWORD_KEY,
 	KEYRING_TOKEN_KEY,
@@ -46,6 +47,8 @@ const readAuthFile = () => JSON.parse(readFileSync(AUTH_FILE_PATH(), 'utf-8'));
 describe('credentials', () => {
 	beforeEach(() => {
 		vitest.stubEnv('__APIFY_INTERNAL_TEST_AUTH_PATH__', cryptoRandomObjectId(12));
+		// The resolver reads APIFY_TOKEN, so a token in the developer's shell would leak into tests.
+		vitest.stubEnv('APIFY_TOKEN', '');
 		resetKeyringMock();
 		writeFileSyncSpy.mockClear();
 		__resetCredentialsForTests();