fix(auth): fall back to OAuth when env token lacks endpoint permissions

fix(auth): fall back to OAuth when env token lacks endpoint permissions #2866