fix(auth): RC_API_KEY outranks the stored OAuth login

[joshdholtz]

Setting RC_API_KEY had no effect once a profile held an OAuth login — the stored login silently won, so scripts and CI runs could act on the wrong account. Env vars are the standard override everywhere else (gh, aws, stripe), so the credential order now matches: --api-key flag, then RC_API_KEY, then the OAuth login, then the stored key.

The existing multiple-credentials warning now reads the right way around, and a shadowed OAuth token no longer gets silently refreshed and re-saved on runs it isn't used for.

$ RC_API_KEY=sk_... rc auth status
✓ Logged in as dev@example.com (profile: default)
  Credential                  the RC_API_KEY environment variable
! Multiple credentials found — using the RC_API_KEY environment variable; ignoring the OAuth login in this profile.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes global auth precedence and refresh behavior, which can shift which account commands use when OAuth and env keys coexist; impact is mostly clearer warnings and more predictable overrides.

Overview
RC_API_KEY and --api-key now win over a profile OAuth login, matching typical CLI override behavior so CI and one-off env runs use the account they name instead of the logged-in profile silently.

Credential resolution, conflict warnings, and docs are aligned with precedence flag → RC_API_KEY → OAuth → stored key. rc auth status no longer shows cached profile email/name or auth_origin when an env/flag override is active; conflict output names the shadowed login correctly. OAuth silent refresh runs only when OAuth is the active source, avoiding refresh/save of a token that is not in use. Fresh logins use SetOAuthTokens, which clears ambient overrides for the rest of the invocation like SetAPIKey.

Rico rejects sk_ credentials up front (login-only backend) with actionable errors, including when RC_API_KEY overrides a stored login. Paywall AI still accepts scoped sk_ keys; Rico tests use atk_ tokens.

^{Reviewed by Cursor Bugbot for commit 12e36ae. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7fa6fe7. Configure here.}