diff --git a/bin/remove-queued-jobs.sh b/bin/remove-queued-jobs.sh
deleted file mode 100755
index ce5ab8cb9..000000000
--- a/bin/remove-queued-jobs.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-token=$GH_TOKEN
-repo=brevdev/brev-cli
-# get ids of all queued github actions runs for the repo
-ids=$(curl -s -H "Authorization: token $token" "https://api.github.com/repos/$repo/actions/runs?status=queued&per_page=100" | jq -r '.workflow_runs[].id')
-set -- $ids
-for i; do curl \
-    -H "Authorization: token $token" \
-    -X POST "https://api.github.com/repos/$repo/actions/runs/$i/cancel"; done
diff --git a/pkg/auth/auth.go b/pkg/auth/auth.go
index 9ae7d3b76..e4f85a81d 100644
--- a/pkg/auth/auth.go
+++ b/pkg/auth/auth.go
@@ -75,6 +75,8 @@ func NewOAuthRetriever(oauths []OAuth) *OAuthRetriever {
 	}
 }
 
+var ErrNoOAuthForToken = errors.New("no oauth found for token")
+
 func (o *OAuthRetriever) GetByProvider(provider entity.CredentialProvider) (OAuth, error) {
 	for _, oauth := range o.oauths {
 		if oauth.GetCredentialProvider() == provider {
@@ -90,7 +92,7 @@ func (o *OAuthRetriever) GetByToken(token string) (OAuth, error) {
 			return oauth, nil
 		}
 	}
-	return nil, fmt.Errorf("no oauth found for token")
+	return nil, ErrNoOAuthForToken
 }
 
 type Auth struct {
@@ -568,11 +570,14 @@ func StandardLogin(authProvider string, email string, tokens *entity.AuthTokens)
 	})
 
 	if tokens != nil && tokens.AccessToken != "" && tokens.APIKey == "" {
-		authenticatorFromToken, errr := authRetriever.GetByToken(tokens.AccessToken)
-		if errr != nil {
-			fmt.Printf("%v\n", errr)
-		} else {
+		authenticatorFromToken, err := authRetriever.GetByToken(tokens.AccessToken)
+		switch {
+		case err == nil:
 			authenticator = authenticatorFromToken
+		case errors.Is(err, ErrNoOAuthForToken):
+			// make user re-authenticate rather than printing an error.
+		default:
+			breverrors.GetDefaultErrorReporter().ReportError(err)
 		}
 	}
 
diff --git a/pkg/auth/auth0.go b/pkg/auth/auth0.go
index 2296397ae..d6e82365e 100644
--- a/pkg/auth/auth0.go
+++ b/pkg/auth/auth0.go
@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
+	"slices"
 	"strings"
 	"time"
 
@@ -18,8 +19,6 @@ import (
 const (
 	audiencePath           = "/api/v2/"
 	waitThresholdInSeconds = 1
-	// namespace used to set/get values from the keychain.
-	SecNamespace = "auth0-cli"
 )
 
 var requiredScopes = []string{
@@ -321,13 +320,7 @@ func (a Auth0Authenticator) GetNewAuthTokensWithRefresh(refreshToken string) (*e
 }
 
 func ErrorIfBadHTTP(r *http.Response, exceptStatus ...int) error {
-	shouldExcept := false
-	for _, s := range exceptStatus {
-		if r.StatusCode == s {
-			shouldExcept = true
-			break
-		}
-	}
+	shouldExcept := slices.Contains(exceptStatus, r.StatusCode)
 
 	if IsError(r.StatusCode) && !shouldExcept {
 		return NewHTTPResponseError(r)
diff --git a/pkg/auth/auth_test.go b/pkg/auth/auth_test.go
index 03664e772..fd8f15f33 100644
--- a/pkg/auth/auth_test.go
+++ b/pkg/auth/auth_test.go
@@ -413,6 +413,38 @@ func TestStandardLogin_APIKeyCredentialDoesNotProbeOAuthProviders(t *testing.T)
 	assert.Empty(t, string(out))
 }
 
+func TestStandardLogin_UnknownCredentialDoesNotPrint(t *testing.T) {
+	for _, token := range []string{BrevAPIKeyPrefix + "legacy-key", "auto-login"} {
+		t.Run(token, func(t *testing.T) {
+			oldStdout := os.Stdout
+			t.Cleanup(func() {
+				os.Stdout = oldStdout
+			})
+			readPipe, writePipe, err := os.Pipe()
+			require.NoError(t, err)
+			os.Stdout = writePipe
+
+			authenticator := StandardLogin("", "", &entity.AuthTokens{
+				AccessToken:  token,
+				RefreshToken: "refresh-token",
+			})
+
+			assert.NoError(t, writePipe.Close())
+			os.Stdout = oldStdout
+			out, err := io.ReadAll(readPipe)
+			assert.NoError(t, err)
+			assert.Empty(t, string(out))
+			_, ok := authenticator.(KasAuthenticator)
+			assert.True(t, ok, "unrecognized credential must fall back to the default provider")
+		})
+	}
+}
+
+func TestOAuthRetrieverGetByToken_NoMatchReturnsSentinel(t *testing.T) {
+	_, err := NewOAuthRetriever(nil).GetByToken("not-a-jwt")
+	assert.ErrorIs(t, err, ErrNoOAuthForToken)
+}
+
 func TestSuccessNoRefreshGetFreshAccessTokenOrLogin(t *testing.T) {
 	s := MockAuthStore{authTokens: &entity.AuthTokens{
 		AccessToken:  validToken,
diff --git a/pkg/cmd/cmd.go b/pkg/cmd/cmd.go
index 0cc0b8a81..09113ae94 100644
--- a/pkg/cmd/cmd.go
+++ b/pkg/cmd/cmd.go
@@ -186,7 +186,7 @@ func NewBrevCommand() *cobra.Command { //nolint:funlen,gocognit,gocyclo // defin
 				}
 			}
 			if apiKeyFlag != "" {
-				os.Setenv(auth.APIKeyEnvVar, apiKeyFlag)
+				_ = os.Setenv(auth.APIKeyEnvVar, apiKeyFlag)
 			}
 			if userFlag != "" {
 				_, err := noLoginCmdStore.WithUserID(userFlag)
diff --git a/pkg/store/user.go b/pkg/store/user.go
index 444c24d01..879b0608d 100644
--- a/pkg/store/user.go
+++ b/pkg/store/user.go
@@ -119,13 +119,8 @@ func (s AuthHTTPStore) UpdateUser(userID string, updatedUser *entity.UpdateUser)
 	return &result, nil
 }
 
-// 	userIDParamName = "userID"
-// 	userIDParamStr  = fmt.Sprintf("{%s}", userIDParamName)
-
 var usersIDPathPattern = fmt.Sprintf("%s/%s", usersPath, "%s")
 
-// usersIDPath        = fmt.Sprintf(usersIDPathPattern, fmt.Sprintf("{%s}", userIDParamStr))
-
 func (s AuthHTTPStore) GetUserByID(userID string) (*entity.User, error) {
 	var result entity.User
 	res, err := s.authHTTPClient.restyClient.R().