@@ -87,10 +87,15 @@ override and takes precedence over anything written to disk.`,
 			return runAccessTokenLogin(accessToken, baseURL)
 		}
 
+		loginSlug, err := loginEnvironmentSlug(cmd)
+		if err != nil {
+			return err
+		}
+
 		// Explicit API-key path. Direct, no browser. Backward compatible
 		// with the original login UX.
 		if apiKey != "" || (!useBrowser && os.Getenv("RETAB_API_KEY") != "") {
-			return runAPIKeyLogin(apiKey, baseURL)
+			return runAPIKeyLogin(apiKey, baseURL, loginSlug)
 		}
 
 		// If `--no-browser` was requested and no key was given, prompt.
@@ -100,7 +105,7 @@ override and takes precedence over anything written to disk.`,
 				return err
 			}
 			if strings.TrimSpace(prompted) != "" {
-				return runAPIKeyLogin(prompted, baseURL)
+				return runAPIKeyLogin(prompted, baseURL, loginSlug)
 			}
 			// fall through to browser flow
 		}
@@ -228,7 +233,15 @@ func chooseLoginEnvironment(currentEnvironmentID string, list *cliPaginatedList[
 
 // runAPIKeyLogin persists an organization API key. Access tokens must use
 // runAccessTokenLogin so they are stored separately and sent as Bearer.
-func runAPIKeyLogin(apiKey, baseURL string) error {
+// runAPIKeyLogin stores an API key. When slug is empty the key becomes the
+// single top-level credential (the original, pre-environments behavior). When
+// slug is set — `auth login --env <slug>` or its `--live` alias — the key is
+// stored as that named environment profile instead, which is the only thing
+// `--env <slug>`/`--live` ever read at request time. Without this branch the
+// profile map had six readers and no writer, so those two selector flags could
+// not be satisfied by any command: their own remediation text sent users here,
+// this function wrote `api_key`, and the next `--live` call failed identically.
+func runAPIKeyLogin(apiKey, baseURL, slug string) error {
 	if apiKey == "" {
 		apiKey = os.Getenv("RETAB_API_KEY")
 	}
@@ -246,11 +259,42 @@ func runAPIKeyLogin(apiKey, baseURL string) error {
 		return fmt.Errorf("access tokens must be passed with --access-token, not --api-key")
 	}
 	cfg, _ := loadConfig()
+	resolvedBaseURL := stripLegacyV1Suffix(configuredLoginBaseURL(baseURL))
+
+	if slug != "" {
+		normalized, err := validateSlug(slug)
+		if err != nil {
+			return err
+		}
+		if cfg.Environments == nil {
+			cfg.Environments = map[string]*environmentProfile{}
+		}
+		profile := cfg.Environments[normalized]
+		if profile == nil {
+			profile = &environmentProfile{CreatedAt: time.Now().UTC().Format(time.RFC3339)}
+			cfg.Environments[normalized] = profile
+		}
+		profile.APIKey = apiKey
+		profile.APIKeyPreview = previewAPIKey(apiKey)
+		profile.BaseURL = resolvedBaseURL
+		// A first named profile also becomes the default, so plain commands
+		// keep working after an environment-scoped login.
+		if cfg.DefaultEnvironment == "" {
+			cfg.DefaultEnvironment = normalized
+		}
+		if err := saveConfig(cfg); err != nil {
+			return err
+		}
+		path, _ := configPath()
+		fmt.Fprintf(os.Stderr, "Saved API key for environment %q to %s\n", normalized, path)
+		return nil
+	}
+
 	cfg.APIKey = apiKey
 	// Wipe stale bearer state — explicit API-key login is the user's intent.
 	cfg.OAuth = nil
 	cfg.AccessToken = ""
-	cfg.BaseURL = stripLegacyV1Suffix(configuredLoginBaseURL(baseURL))
+	cfg.BaseURL = resolvedBaseURL
 	if err := saveConfig(cfg); err != nil {
 		return err
 	}
@@ -259,6 +303,51 @@ func runAPIKeyLogin(apiKey, baseURL string) error {
 	return nil
 }
 
+// previewAPIKey renders the redacted form kept alongside a stored profile so
+// list views never have to read the raw key: prefix through the second
+// underscore, then the last four characters ("rt_test_...9f2c").
+func previewAPIKey(apiKey string) string {
+	if len(apiKey) < 4 {
+		return "..."
+	}
+	tail := apiKey[len(apiKey)-4:]
+	prefixEnd := 0
+	for seen := 0; prefixEnd < len(apiKey) && seen < 2; prefixEnd++ {
+		if apiKey[prefixEnd] == '_' {
+			seen++
+		}
+	}
+	if prefixEnd == 0 || prefixEnd >= len(apiKey)-4 {
+		return "..." + tail
+	}
+	return apiKey[:prefixEnd] + "..." + tail
+}
+
+// loginEnvironmentSlug resolves the environment profile an API-key login should
+// write to from the --env/--live selectors, mirroring how resolveCredential
+// reads them ("live" folds onto "production"). Empty means an unscoped login.
+func loginEnvironmentSlug(cmd *cobra.Command) (string, error) {
+	envFlag, _ := cmd.Flags().GetString("env")
+	live, _ := cmd.Flags().GetBool("live")
+	if envFlag != "" && live {
+		normalized, err := validateSlug(envFlag)
+		if err != nil {
+			return "", err
+		}
+		if normalized != slugProduction {
+			return "", fmt.Errorf("--live conflicts with --env %s; --live is an alias for --env production", envFlag)
+		}
+		return slugProduction, nil
+	}
+	if live {
+		return slugProduction, nil
+	}
+	if envFlag != "" {
+		return validateSlug(envFlag)
+	}
+	return "", nil
+}
+
 func runAccessTokenLogin(accessToken, baseURL string) error {
 	accessToken = strings.TrimSpace(accessToken)
 	if accessToken == "" {
 
@@ -529,7 +529,7 @@ func TestAPIKeyLoginDefaultsToProductionInsteadOfStoredLocalhost(t *testing.T) {
 		t.Fatalf("saveConfig: %v", err)
 	}
 
-	if err := runAPIKeyLogin("sk_live_test", ""); err != nil {
+	if err := runAPIKeyLogin("sk_live_test", "", ""); err != nil {
 		t.Fatalf("runAPIKeyLogin: %v", err)
 	}
 	cfg, err := loadConfig()
@@ -574,7 +574,7 @@ func TestAPIKeyLoginRejectsAccessTokenPrefix(t *testing.T) {
 	t.Setenv("HOME", t.TempDir())
 	t.Setenv("RETAB_API_KEY", "")
 
-	err := runAPIKeyLogin("acctk_production_secret", "")
+	err := runAPIKeyLogin("acctk_production_secret", "", "")
 	if err == nil || !strings.Contains(err.Error(), "--access-token") {
 		t.Fatalf("expected --access-token guidance, got %v", err)
 	}
@@ -1130,3 +1130,79 @@ func TestPromptSecretEOFHandling(t *testing.T) {
 		t.Errorf("empty stdin: got (%q, nil), want error", got)
 	}
 }
+
+// TestAPIKeyLoginWritesEnvironmentProfile pins the writer for the named
+// credential profiles. `--env <slug>` and `--live` read
+// cfg.Environments[slug].APIKey at request time; before this, six call sites
+// read that map and nothing ever wrote it, so both selectors were unreachable
+// and their own remediation text ("retab env add <slug> --api-key <key>", a
+// command that does not exist) could not fix it.
+func TestAPIKeyLoginWritesEnvironmentProfile(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("RETAB_API_KEY", "")
+
+	if err := runAPIKeyLogin("rt_test_abc1234", "", "staging"); err != nil {
+		t.Fatalf("runAPIKeyLogin: %v", err)
+	}
+	cfg, err := loadConfig()
+	if err != nil {
+		t.Fatalf("loadConfig: %v", err)
+	}
+	profile := cfg.Environments["staging"]
+	if profile == nil || profile.APIKey != "rt_test_abc1234" {
+		t.Fatalf("staging profile = %#v, want the stored key", profile)
+	}
+	if profile.APIKeyPreview != "rt_test_...1234" {
+		t.Fatalf("preview = %q, want a redacted preview", profile.APIKeyPreview)
+	}
+	if cfg.DefaultEnvironment != "staging" {
+		t.Fatalf("DefaultEnvironment = %q, want staging", cfg.DefaultEnvironment)
+	}
+	// An environment-scoped login must not also claim the unscoped slot;
+	// that is what made the old behavior look like it had worked.
+	if cfg.APIKey != "" {
+		t.Fatalf("APIKey = %q, want empty for a scoped login", cfg.APIKey)
+	}
+}
+
+// TestAPIKeyLoginLiveFoldsOntoProduction covers the --live alias writing the
+// same profile --live later reads.
+func TestAPIKeyLoginLiveFoldsOntoProduction(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("RETAB_API_KEY", "")
+
+	if err := runAPIKeyLogin("rt_live_xyz9876", "", "live"); err != nil {
+		t.Fatalf("runAPIKeyLogin: %v", err)
+	}
+	cfg, err := loadConfig()
+	if err != nil {
+		t.Fatalf("loadConfig: %v", err)
+	}
+	if cfg.Environments["production"] == nil {
+		t.Fatalf("environments = %#v, want the live alias folded onto production", cfg.Environments)
+	}
+	if cfg.Environments["live"] != nil {
+		t.Fatalf("environments has a literal \"live\" profile, want it normalized")
+	}
+}
+
+// TestAPIKeyLoginUnscopedKeepsLegacyShape guards the pre-environments path:
+// no --env/--live means the key still lands in the top-level slot.
+func TestAPIKeyLoginUnscopedKeepsLegacyShape(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("RETAB_API_KEY", "")
+
+	if err := runAPIKeyLogin("rt_live_plain999", "", ""); err != nil {
+		t.Fatalf("runAPIKeyLogin: %v", err)
+	}
+	cfg, err := loadConfig()
+	if err != nil {
+		t.Fatalf("loadConfig: %v", err)
+	}
+	if cfg.APIKey != "rt_live_plain999" {
+		t.Fatalf("APIKey = %q, want the unscoped key", cfg.APIKey)
+	}
+	if len(cfg.Environments) != 0 {
+		t.Fatalf("environments = %#v, want none for an unscoped login", cfg.Environments)
+	}
+}
@@ -21,6 +21,7 @@ import (
 	"path"
 	"path/filepath"
 	"regexp"
+	"sort"
 	"strconv"
 	"strings"
 	"sync"
@@ -229,6 +230,14 @@ func renderAPIErrorForCLI(cmd *cobra.Command, apiErr *retab.APIError) string {
 		}
 		return strings.Join(lines, "\n")
 	}
+	if issueLines, issueCount := formatAPIErrorIssueLines(apiErr.Details); len(issueLines) > 0 {
+		lines := []string{fmt.Sprintf("%d — %s", apiErr.StatusCode, summarizeIssueCount(issueCount))}
+		lines = append(lines, issueLines...)
+		if apiErr.RequestID != "" {
+			lines = append(lines, "  Request-ID: "+apiErr.RequestID)
+		}
+		return strings.Join(lines, "\n")
+	}
 	message := apiErr.Message
 	if detail := usefulAPIErrorDetail(apiErr.Details); detail != "" && isGenericAPIErrorMessage(message) {
 		message = detail
@@ -313,6 +322,122 @@ func usefulAPIErrorDetail(details map[string]any) string {
 	return ""
 }
 
+// formatAPIErrorIssueLines renders the full problem list an endpoint returned
+// instead of just the first one. The declarative spec compiler is the
+// motivating case: `workflows spec validate/plan/apply` exists precisely to
+// report everything wrong with a spec, but the error body's summary message
+// only names issue #1 and appends "(N issues)". Rendering just that summary
+// forced a fix-one-retry loop through N round trips and threw away the
+// per-issue yaml_path plus the details map, which frequently spells out the
+// fix (available_handles being the clearest example).
+//
+// Returns nil when there is no issue list, so callers fall back to the plain
+// message rendering. The second return is the number of issues rendered, which
+// is not len(lines): a single issue can also emit indented hint lines.
+func formatAPIErrorIssueLines(details map[string]any) ([]string, int) {
+	raw, ok := details["errors"].([]any)
+	if !ok || len(raw) == 0 {
+		return nil, 0
+	}
+	lines := make([]string, 0, len(raw))
+	issues := 0
+	for _, entry := range raw {
+		issue, ok := entry.(map[string]any)
+		if !ok {
+			continue
+		}
+		message := strings.TrimSpace(issueTextFromAny(issue["message"]))
+		yamlPath := strings.TrimSpace(issueTextFromAny(issue["yaml_path"]))
+		// The server already prefixes most messages with the yaml path; only
+		// add it when it is genuinely missing so the line does not stutter.
+		if yamlPath != "" && !strings.HasPrefix(message, yamlPath) {
+			if message == "" {
+				message = yamlPath
+			} else {
+				message = yamlPath + ": " + message
+			}
+		}
+		if message == "" {
+			continue
+		}
+		if severity := strings.TrimSpace(issueTextFromAny(issue["severity"])); severity != "" && severity != "error" {
+			message = strings.ToUpper(severity) + ": " + message
+		}
+		if code := strings.TrimSpace(issueTextFromAny(issue["code"])); code != "" {
+			message += "  [" + code + "]"
+		}
+		lines = append(lines, "  - "+message)
+		lines = append(lines, formatIssueDetailHints(issue["details"])...)
+		issues++
+	}
+	return lines, issues
+}
+
+// formatIssueDetailHints surfaces the list-valued entries of an issue's details
+// map ("available_handles": [...] and friends). Those enumerate the legal
+// values, so they turn "handle X is not valid" into an actionable message.
+// Scalar detail keys are skipped: they are already quoted in the message.
+func formatIssueDetailHints(raw any) []string {
+	details, ok := raw.(map[string]any)
+	if !ok || len(details) == 0 {
+		return nil
+	}
+	keys := make([]string, 0, len(details))
+	for key := range details {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+
+	hints := make([]string, 0, len(keys))
+	for _, key := range keys {
+		values, ok := details[key].([]any)
+		if !ok || len(values) == 0 {
+			continue
+		}
+		rendered := make([]string, 0, len(values))
+		for _, value := range values {
+			if text := strings.TrimSpace(issueTextFromAny(value)); text != "" {
+				rendered = append(rendered, text)
+			}
+		}
+		if len(rendered) == 0 {
+			continue
+		}
+		label := strings.ReplaceAll(key, "_", " ")
+		hints = append(hints, fmt.Sprintf("    %s: %s", label, strings.Join(rendered, ", ")))
+	}
+	return hints
+}
+
+// summarizeIssueCount builds the header line above an expanded issue list.
+// The server's summary message is always a copy of issue #1 (with "(N issues)"
+// glued on when there are several), and issue #1 is about to be printed as the
+// first bullet, so echoing the message here would print it twice. A bare count
+// is the one thing the bullets do not already say.
+func summarizeIssueCount(count int) string {
+	if count == 1 {
+		return "1 issue found:"
+	}
+	return fmt.Sprintf("%d issues found:", count)
+}
+
+// issueTextFromAny is the tolerant sibling of stringFromAny: issue detail
+// values arrive as free-form JSON, so numbers and bools must render too.
+func issueTextFromAny(value any) string {
+	switch typed := value.(type) {
+	case string:
+		return typed
+	case nil:
+		return ""
+	case float64:
+		return strconv.FormatFloat(typed, 'f', -1, 64)
+	case bool:
+		return strconv.FormatBool(typed)
+	default:
+		return fmt.Sprint(typed)
+	}
+}
+
 type validationErrorLine struct {
 	Location []any  `json:"loc"`
 	Message  string `json:"msg"`