Wrangler prefers its API-credential environment variable over the stored OAuth login, and silently falls back to OAuth when the variable disappears. Pin account_id in wrangler.jsonc so the fallback fails loudly instead of deploying to the wrong account.
Wrangler auth precedence on a machine with multiple Cloudflare identities (e.g. personal + work): if wrangler's documented API-credential environment variable is set, wrangler uses it and ignores the stored OAuth login from wrangler login. If that env var is absent — new shell, restarted session, CI missing the secret — wrangler silently falls back to the stored OAuth identity.
That fallback is the dangerous part: a deploy that worked yesterday (env credential set) can land on the wrong account today (env lost, OAuth used) with no warning, because the project config alone doesn't carry identity.
Two-part pattern that worked well:
wrangler logout/login churn — the OAuth login stays untouched for other projects."account_id": "<target account>" in wrangler.jsonc. Then the OAuth-fallback scenario fails immediately with Authentication error [code: 10000] plus a hint to check account_id, instead of deploying to the wrong account.Observed live: with the pin in place and the environment lost, wrangler deploy was rejected outright; wrangler whoami confirmed the fallback identity. Restoring the environment fixed it with zero side effects on the other account's credentials.
Also worth knowing: wrangler whoami states which mechanism is active (OAuth vs a user credential read from the environment) — check it first when a deploy authenticates as the wrong person.