SonarSource/sonarqube · error · IllegalStateException

The token expired on

Error message

The token expired on 

What it means

UserTokenAuthentication.authenticate(token) checks the token's expiration date after loading it. If userToken.isExpired() is true, it throws IllegalStateException('The token expired on <date>'). The token exists in the database but is no longer valid because its set expiration date has passed.

Source

Thrown at server/sonar-webserver-auth/src/main/java/org/sonar/server/usertoken/UserTokenAuthentication.java:123

          .build();
      }
      request.setAttribute(ACCESS_LOG_TOKEN_NAME, userToken.getName());
      return new UserAuthResult(userDto, userToken, UserAuthResult.AuthType.TOKEN);
    } catch (NotFoundException | IllegalStateException exception) {
      throw AuthenticationException.newBuilder()
        .setSource(AuthenticationEvent.Source.local(AuthenticationEvent.Method.SONARQUBE_TOKEN))
        .setMessage(exception.getMessage())
        .build();
    }
  }

  private UserTokenDto authenticate(String token) {
    UserTokenDto userToken = getUserToken(token);
    if (userToken == null) {
      throw new NotFoundException("Token doesn't exist");
    }
    if (userToken.isExpired()) {
      throw new IllegalStateException("The token expired on " + formatDateTime(userToken.getExpirationDate()));
    }
    userLastConnectionDatesUpdater.updateLastConnectionDateIfNeeded(userToken);
    return userToken;
  }

  @Nullable
  public UserTokenDto getUserToken(String token) {
    try (DbSession dbSession = dbClient.openSession(false)) {
      return dbClient.userTokenDao().selectByTokenHash(dbSession, tokenGenerator.hash(token));
    }
  }
}

View on GitHub (pinned to 184c821202)

Solutions

1. Generate a new token (optionally a longer or non-expiring one if policy allows) and update the pipeline/secret store
2. Check the expiration date in the error message / My Account > Security and plan rotation before it lapses
3. If expiration policies are too strict for service accounts, an administrator can adjust the token max lifetime server setting
4. Automate token rotation before the expiration date to prevent recurring failures

Example fix

// before
SONAR_TOKEN=sqp_123...  # expired 2026-08-01
// after
SONAR_TOKEN=sqp_456...  # freshly generated, expiry 2027-01-01

// if using the API, check token expiry info where exposed; otherwise record expiry at creation time
const expiresAt = tokenMetadata.expiresAt; // stored when token was created
if (expiresAt && Date.parse(expiresAt) <= Date.now()) throw new Error('SonarQube token expired; rotate before use');

null

try {
  await sonarRequest(token);
} catch (err) {
  if (/token expired on/i.test(err.response?.data?.errors?.[0]?.msg ?? '')) {
    token = await rotateSonarToken();
    return sonarRequest(token);
  }
  throw err;
}

When it happens

Trigger: Authenticating with a user token that was created with an expiration date (e.g. 30/90-day token) and that date has passed. Common with CI tokens that expire unnoticed.

Common situations: Long-running pipelines or scheduled jobs whose stored token expired; team token-expiration policies in SonarQube (sonar.auth.token.expiration settings); users surprised by enforced expiry after upgrades.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Identity provider %s does not exist or is not enabled
• Authentication is required
• User is not authenticated
• Token doesn't exist
• You're not authorized to push analysis results to the SonarQ

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/7b9a2628b01a6dd7. Report an issue: GitHub.