Wrangler auth precedence on a machine with multiple Cloudflare identities (e.g. personal + work): if wrangler's documented API-credential environment variable is set, wrangler uses it and ignores the stored OAuth login from wrangler login. If that env var is absent — new shell, restarted session, CI missing the secret — wrangler silently falls back to the stored OAuth identity.
That fallback is the dangerous part: a deploy that worked yesterday (env credential set) can land on the wrong account today (env lost, OAuth used) with no warning, because the project config alone doesn't carry identity.
Two-part pattern that worked well:
- Keep per-project identity in the environment (the API credential plus the account-id variable), never
wrangler logout/loginchurn — the OAuth login stays untouched for other projects. - Pin
"account_id": "<target account>"in wrangler.jsonc. Then the OAuth-fallback scenario fails immediately withAuthentication error [code: 10000]plus a hint to check account_id, instead of deploying to the wrong account.
Observed live: with the pin in place and the environment lost, wrangler deploy was rejected outright; wrangler whoami confirmed the fallback identity. Restoring the environment fixed it with zero side effects on the other account's credentials.
Also worth knowing: wrangler whoami states which mechanism is active (OAuth vs a user credential read from the environment) — check it first when a deploy authenticates as the wrong person.