T3 Connect: /oauth/token returns EnvironmentAuthInvalidError after relinking environment, making Desktop and iOS unable to connect #5712

Summary

After relinking a T3 Connect environment, all T3 Connect clients (Desktop and iOS) fail to connect with an invalid environment credential.

The server is healthy, the managed Cloudflare tunnel connects successfully, and the request reaches the environment, but the /oauth/token endpoint returns 401 because the server throws EnvironmentAuthInvalidError.

While investigating this, t3 connect unlink consistently fails to delete the relay environment with an HTTP 500.

Versions

• Server: 0.0.33-nightly.20260808.1033
• Desktop: 0.0.33-nightly.20260808.1033
• iOS: latest

Reproduction

1. t3 connect unlink
2. Observe HTTP 500 deleting the relay environment.
3. t3 connect link
4. Restart the server.
5. Remove and rediscover the environment in Desktop.
6. Attempt to connect.

Actual

POST /oauth/token returns 401.

Server trace shows:

EnvironmentAuthInvalidError
at environment.auth.token

Desktop and iOS both fail.

Additional observations

• Managed tunnel registers successfully over HTTP/2.
• cloud-relay-environment-credential.bin was regenerated from scratch but the problem persisted.
• Relay unlink consistently fails with HTTP 500 for environment link:

967fa7f8-ef96-491c-b9e7-4a8556c92f22

• Managed tunnel cleanup logs:

Failed to release the managed tunnel on shutdown; the next link reuses it

Trace IDs

• cb140cf61d99c3ad1b2730edab7fbd23
• 3e6ead097e29d918e9394b86ec38afbd

Happy to provide additional diagnostics if needed.