docs(auth): set the October 20 switchover date and cover older CLIs

[djsauble]

What

Updates Authentication, the page go.flox.dev/auth redirects to, with the switchover date and the behavior that actually ships.

This page announces a dated change, so it should merge before the switchover announcements go out. It is not held for the 1.19.0 release.

• Date. "Early October 2026" becomes Tuesday, October 20, 2026 (Flox 1.19.0) in the intro, the "What's changing" text and the FAQ. The "we'll follow up with the specific date" promise is replaced by the date.
• Which commands need a sign-in. The fixed command list becomes "every command that resolves packages", with what counts as resolving. flox edit needs a sign-in only when a catalog package or a system changes. flox init always creates the environment; only its Node.js, Python or Go package suggestions need one.
• What stays open. Adds flox build when the environment's lockfile is current.
• GitHub Actions. New subsection for the floxhub-token input of flox/install-flox-action.
• Older Flox versions. New section. The catalog enforces the requirement, so it applies to every Flox version from October 20. A login works from 1.3.5 on, personal access tokens and service account tokens need 1.14.0, and versions before 1.3.5 must upgrade.
• FAQ. New entry for turning off the login reminder (auth_notifications / FLOX_AUTH_NOTIFICATIONS), which silences the reminder but not the errors. "What if I miss the deadline?" now says the command fails with an error instead of prompting.

flox publish stays out of the "changing" list on purpose. It already requires a sign-in, and the page says so under "What stays the same".

Sources

• CLI behavior: feat(auth): handle 401 for /resolve flox#4787.
• Version lines: release binaries 1.3.4, 1.3.5, 1.3.17, 1.4.0, 1.11.2, 1.11.4, 1.13.2, 1.14.0 and 1.18.1, run against a local capture server with a login token, a personal access token and a service account token. A login token is sent on resolve from 1.3.5 on. 1.3.4 never sends one, even when logged in.
• floxhub-token: feat: add floxhub-token field to allow auth install-flox-action#226, released in v2.7.0. The v2 tag points at that release.
• FLOX_AUTH_NOTIFICATIONS=false: tested on Flox 1.18.1. The setting first shipped in 1.15.0.

Before merging

• Confirm the catalog starts enforcing on October 20, the release date, and not at the release candidate.
• The catalog's message to older CLIs says versions before 1.4.0 must upgrade first. The page says 1.3.5, which is what the releases do. Align the message, or accept the difference.
• docs(concepts): add What Flox collects page #107 rewrites the same "What's changing" section. This PR reuses its wording for the command list so the two agree, but docs(concepts): add What Flox collects page #107 needs a rebase after this merges.

Testing

• mint dev: the page renders, and the new #older-flox-versions and #github-actions anchors resolve.
• mint broken-links: no broken links on this page. On the repo as it stands the command stops on a parse error in AGENTS.md (the HTML comment at line 94), which is unrelated to this PR, so I ran it on a copy without that file. The only hits were the three existing /changelog/rss.xml links.
• ./scripts/generate-llms-txt.sh: no change, since the page's title and description are the same.

Fixes DEV-355

🤖 Generated with Claude Code

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
flox	🟢 Ready	View Preview	Oct 9, 2026, 6:32 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[jbayer]

Looks good!

[mkenigs]

Do flox auth tokens work with these versions, just not PATs or SATs?