@@ -19,6 +19,7 @@ import type { Hooks } from "@opencode-ai/plugin"
 import { Process } from "@/util/process"
 import { errorMessage } from "@/util/error"
 import { FreeTier } from "@/altimate/free/client"
+import { AltimateApi } from "@/altimate/api/client"
 import { text } from "node:stream/consumers"
 import { Effect, Option } from "effect"
 
@@ -605,6 +606,14 @@ export const ProvidersLogoutCommand = effectCmd({
         label: (database[key]?.name || key) + UI.Style.TEXT_DIM + " (" + value.type + ")",
         value: key,
       }))
+    // Credentials saved only to ~/.altimate/altimate.json (TUI paste dialog) have no auth-store entry.
+    const hasAltimateBackendFile = yield* Effect.promise(() => AltimateApi.isConfigured())
+    if (hasAltimateBackendFile && !options.some((option) => option.value === "altimate-backend")) {
+      options.push({
+        label: (database["altimate-backend"]?.name || "altimate-backend") + UI.Style.TEXT_DIM + " (api)",
+        value: "altimate-backend",
+      })
+    }
     if (hasAltimateBaseCredential || hasLegacyAltimateBaseCredential || hasAltimateBaseState) {
       options.push({
         label: "Altimate Base" + UI.Style.TEXT_DIM + " (managed)",
@@ -638,6 +647,11 @@ export const ProvidersLogoutCommand = effectCmd({
       yield* Prompt.outro("Logout successful")
       return
     }
+    if (provider === "altimate-backend") {
+      // Browser sign-in persists the gateway key to ~/.altimate/altimate.json, which the provider
+      // loader and every workspace call read first, so sign-out must remove it too.
+      yield* cliTry("Failed to remove Altimate credential: ", () => AltimateApi.clearCredentials())
+    }
     // altimate_change end
     yield* Effect.orDie(authSvc.remove(provider))
     yield* Prompt.outro("Logout successful")
 
@@ -87,6 +87,8 @@ function show(api: TuiPluginApi) {
 async function logout(api: TuiPluginApi) {
   try {
     await AltimateApi.clearCredentials()
+    // A pasted url::instance::key in the auth store keeps the provider loader's fallback path live.
+    await api.client.auth.remove({ providerID: PROVIDER_ID })
     await api.client.instance.dispose()
     api.ui.toast({ variant: "success", message: "Signed out of Altimate LLM Gateway" })
   } catch (err) {
 
@@ -97,4 +97,69 @@ describe("providers logout", () => {
       }),
     120_000,
   )
+
+  cliIt.live(
+    "removes the saved Altimate gateway key along with the auth-store entry",
+    ({ home, opencode }) =>
+      Effect.gen(function* () {
+        const dataDir = path.join(home, ".local", "share", "altimate-code")
+        const authPath = path.join(dataDir, "auth.json")
+        const altimatePath = path.join(home, ".altimate", "altimate.json")
+        const anthropic = { type: "api", key: "anthropic-test-key" }
+        const writeAltimate = () =>
+          fs.writeFile(
+            altimatePath,
+            JSON.stringify({
+              altimateUrl: "https://api.test",
+              altimateInstanceName: "tenant",
+              altimateApiKey: "gateway-test-key",
+            }),
+            { mode: 0o600 },
+          )
+
+        yield* Effect.promise(() => fs.mkdir(dataDir, { recursive: true }))
+        yield* Effect.promise(() => fs.mkdir(path.dirname(altimatePath), { recursive: true }))
+        yield* Effect.promise(() => writeAltimate())
+        yield* Effect.promise(() =>
+          fs.writeFile(
+            authPath,
+            JSON.stringify({ anthropic, "altimate-backend": { type: "api", key: "gateway-test-key" } }),
+            { mode: 0o600 },
+          ),
+        )
+
+        const logout = yield* opencode.spawn(["providers", "logout", "altimate-backend"], {
+          env: { OPENCODE_AUTH_CONTENT: "" },
+        })
+        opencode.expectExit(logout, 0, "providers logout altimate-backend")
+        expect(logout.stdout).toContain("Logout successful")
+        expect(
+          yield* Effect.promise(() =>
+            fs.stat(altimatePath).then(
+              () => true,
+              () => false,
+            ),
+          ),
+        ).toBe(false)
+        expect(JSON.parse(yield* Effect.promise(() => fs.readFile(authPath, "utf8")))).toEqual({ anthropic })
+
+        // Credentials saved only to altimate.json (TUI paste dialog) must still be removable.
+        yield* Effect.promise(() => writeAltimate())
+        const fileOnlyLogout = yield* opencode.spawn(["providers", "logout", "altimate-backend"], {
+          env: { OPENCODE_AUTH_CONTENT: "" },
+        })
+        opencode.expectExit(fileOnlyLogout, 0, "providers logout file-only altimate-backend")
+        expect(fileOnlyLogout.stdout).toContain("Logout successful")
+        expect(
+          yield* Effect.promise(() =>
+            fs.stat(altimatePath).then(
+              () => true,
+              () => false,
+            ),
+          ),
+        ).toBe(false)
+        expect(JSON.parse(yield* Effect.promise(() => fs.readFile(authPath, "utf8")))).toEqual({ anthropic })
+      }),
+    120_000,
+  )
 })