# Users able to deploy without running flyctl auth login

**URL:** <https://community.fly.io/t/users-able-to-deploy-without-running-flyctl-auth-login/17112>\
**Category:** Questions / Help\
**Tags:** login-only\
**Created:** [December 3, 2023, 11:27pm UTC](https://community.fly.io/t/users-able-to-deploy-without-running-flyctl-auth-login/17112 "2023-12-03T23:27:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rory](https://avatars.discourse-cdn.com/v4/letter/r/a183cd/32.png) [@rory](https://community.fly.io/u/rory)\
**Post date:** [December 3, 2023, 11:27pm UTC](https://community.fly.io/t/users-able-to-deploy-without-running-flyctl-auth-login/17112/1 "2023-12-03T23:27:12Z")

</div>

Hey folks, my partner was able to deploy an application into my account without running `flyctl auth login`. They downloaded `flyctl` and then ran `flyctl launch` (just those two commands, no auth), and despite having their own account, the application showed up in my dashboard. We tried resolving this by having them run `flyctl auth login`, having me destroy their application, and having them re-launch. The output for `flyctl orgs list` used to show my organization but after running `flyctl auth login` it shows theirs. However, even after logging in with their account the application is deployed into my organization.

It looks like some entries in `~/.fly/config.yml` still reference my account (interestingly, my _old_ email, not the email currently associated with my account). What’s the preferred method of resolution? Would it suffice to delete their `~/.fly` directory and re-install `flyctl`?

---

<div class="post-metadata">

**Author:** ![btoews](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/btoews/32/15593_2.png) [@btoews](https://community.fly.io/u/btoews)\
**Post date:** [December 4, 2023, 3:15pm UTC](https://community.fly.io/t/users-able-to-deploy-without-running-flyctl-auth-login/17112/2 "2023-12-04T15:15:59Z")

</div>

Hi. Can you share the output of `flyctl version`? Running `flyctl auth logout` should clear your tokens from the configuration and stop the running agent. In older versions of flyctl, the background agent would frequently re-write its token to the configuration file, causing authentication changes to be randomly reverted.

To be extra sure, you could run `flyctl auth logout`, `flyctl agent stop`, and then delete the `~/.fly` directory.

---

<div class="post-metadata">

**Author:** ![rory](https://avatars.discourse-cdn.com/v4/letter/r/a183cd/32.png) [@rory](https://community.fly.io/u/rory)\
**Post date:** [December 4, 2023, 7:07pm UTC](https://community.fly.io/t/users-able-to-deploy-without-running-flyctl-auth-login/17112/3 "2023-12-04T19:07:17Z")

</div>

Thanks for the reply! My partner and I are both using flyctl version 0.1.131. I’ll let them know about restarting the agent and possibly deleting their `~/.fly` directory.

I’m still curious how their flyctl initially set them up to deploy into my organization without having to authenticate. Is there any way I can prevent this from happening in the future?

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/fly1/original/3X/6/e/6e8955d00cb218e186ebbe3a6ab06fefdce15290.svg) [@system](https://community.fly.io/u/system)\
**Post date:** [December 11, 2023, 7:08pm UTC](https://community.fly.io/t/users-able-to-deploy-without-running-flyctl-auth-login/17112/4 "2023-12-11T19:08:14Z")

</div>

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.