SonarSource/sonarqube · error · IllegalArgumentException

Cannot mint a GitLab access token for project '%s': invalid

Error message

Cannot mint a GitLab access token for project '%s': invalid GitLab configuration: %s

What it means

Thrown by GitlabScmAccessTokenProvider.createToken when gitlabGlobalSettingsValidator rejects the ALM setting before minting a GitLab project access token. It signals the stored GitLab DevOps configuration (URL / PAT) is invalid, so short-lived SCM access tokens cannot be provisioned for the project. The original IllegalArgumentException cause is chained.

Source

Thrown at server/sonar-webserver-common/src/main/java/org/sonar/server/common/almsettings/gitlab/GitlabScmAccessTokenProvider.java:163

  }

  private Optional<ScmAccessToken> getCachedToken(TokenCacheKey cacheKey) {
    ScmAccessToken token = tokenCache.getIfPresent(cacheKey);
    if (token == null) {
      return Optional.empty();
    }
    if (isExpiring(token)) {
      tokenCache.invalidate(cacheKey);
      return Optional.empty();
    }
    return Optional.of(token);
  }

  private ScmAccessToken createToken(TokenMintRequest request) {
    try {
      gitlabGlobalSettingsValidator.validate(request.almSetting);
    } catch (IllegalArgumentException e) {
      throw new IllegalArgumentException(format("Cannot mint a GitLab access token for project '%s': invalid GitLab configuration: %s",
        request.safeProjectKey, e.getMessage()), e);
    }
    String gitlabUrl = requireNonNull(request.almSetting.getUrl(), "GitLab url cannot be null");
    String personalAccessToken = requireNonNull(request.almSetting.getDecryptedPersonalAccessToken(encryption), "GitLab personal access token cannot be null");
    LocalDate expiresAt = LocalDate.now(ZoneOffset.UTC).plusDays(TOKEN_LIFETIME_DAYS);
    GitlabProjectAccessToken token = gitlabApplicationClient.createProjectAccessToken(gitlabUrl, personalAccessToken,
      request.cacheKey.gitlabProjectId, REMEDIATION_AGENT_NAME, TOKEN_MINTING_SCOPES, expiresAt);
    return new ScmAccessToken(ALM.GITLAB.getId(), REMEDIATION_AGENT_NAME,
      requireNonNull(token.getToken(), PROJECT_ACCESS_TOKEN_NULL_MESSAGE), formatExpiresAt(token.getExpiresAt(), expiresAt));
  }

  private static boolean isExpiring(ScmAccessToken token) {
    try {
      return token.expiresAt() == null || !LocalDate.parse(token.expiresAt()).isAfter(LocalDate.now(ZoneOffset.UTC).plusDays(TOKEN_ROTATION_MARGIN_DAYS));
    } catch (DateTimeParseException e) {
      return true;
    }
  }

View on GitHub (pinned to 184c821202)

Solutions

1. Open Administration > DevOps Platform Integrations, edit the GitLab setting and re-enter a valid URL and PAT with api scope
2. Re-set the encryption key or re-save secrets after moving/restoring sonar.secretKeyPath so decryption succeeds
3. Check server logs for the chained IllegalArgumentException message from validate() to see the exact invalid field
4. Re-save the ALM setting via the web API api/alm_settings/update to refresh decrypted credentials

Example fix

// before (config)
almSetting.url = null; pat = <encrypted, key lost>
// after
POST api/alm_settings/update with url=https://gitlab.example.com and personalAccessToken=<new PAT with api scope>

// validate before minting
if (almSetting.getUrl() == null || almSetting.getUrl().isBlank()) throw new IllegalArgumentException("GitLab url missing");
try { almSetting.getDecryptedPersonalAccessToken(encryption); } catch (Exception e) { throw new IllegalArgumentException("PAT undecryptable/missing", e); }
gitlabGlobalSettingsValidator.validate(almSetting);

boolean isMintable(AlmSettingDto s, Encryption encryption) {
  return s != null && s.getUrl() != null && !s.getUrl().isBlank()
    && s.getDecryptedPersonalAccessToken(encryption) != null;
}

try {
  ScmAccessToken t = provider.token(projectKey);
} catch (IllegalArgumentException e) {
  // invalid GitLab configuration — surface to admin, do not retry blindly
  log.error("Token minting failed: {}", e.getMessage());
  throw e;
}

When it happens

Trigger: Automatic token minting (e.g. on PR decoration or code analysis) with an ALM setting whose url is null, PAT is null/undecryptable (e.g. encryption key changed), or fails validate() — typically missing or malformed GitLab global configuration.

Common situations: SonarQube encryption secret changed so the stored PAT cannot be decrypted; GitLab ALM setting was created without a PAT; GitLab URL field left blank; PAT deleted on GitLab side causing validation failure.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• GitLab Merge Request did not happen, please check your confi
• Failed to fetch GitLab project with ID '%s' from '%s'
• Could not parse GitLab answer to verify token. Got a non-jso
• Could not validate GitLab token. Got an unexpected answer.
• Could not validate GitLab write permission. Got an unexpecte

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/92edcb3da702a2f9. Report an issue: GitHub.