{"record":{"id":"1b54dc4af0cf6984","repo":"phacility/phabricator","slug":"unable-to-load-api-token-s-1b54dc","errorCode":null,"errorMessage":"Unable to load API token (\"%s\")!","messagePattern":"Unable to load API token \\(\"(.+?)\"\\)!","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/harbormaster/step/HarbormasterCircleCIBuildStepImplementation.php","lineNumber":142,"sourceCode":"          'Object (\"%s\") claims \"%s\" is a GitHub repository URI, but the '.\n          'path (\"%s\") does not have enough components (expected at least '.\n          'two).',\n          $object_phid,\n          $github_uri,\n          $path));\n    }\n\n    list($github_namespace, $github_name) = $path_parts;\n    $github_name = preg_replace('(\\\\.git$)', '', $github_name);\n\n    $credential_phid = $this->getSetting('token');\n    $api_token = id(new PassphraseCredentialQuery())\n      ->setViewer($viewer)\n      ->withPHIDs(array($credential_phid))\n      ->needSecrets(true)\n      ->executeOne();\n    if (!$api_token) {\n      throw new Exception(\n        pht(\n          'Unable to load API token (\"%s\")!',\n          $credential_phid));\n    }\n\n    // When we pass \"revision\", the branch is ignored (and does not even need\n    // to exist), and only shows up in the UI. Use a cute string which will\n    // certainly never break anything or cause any kind of problem.\n    $ship = \"\\xF0\\x9F\\x9A\\xA2\";\n    $branch = \"{$ship}Harbormaster\";\n\n    $token = $api_token->getSecret()->openEnvelope();\n    $parts = array(\n      'https://circleci.com/api/v1/project',\n      phutil_escape_uri($github_namespace),\n      phutil_escape_uri($github_name).\"?circle-token={$token}\",\n    );\n","sourceCodeStart":124,"sourceCodeEnd":160,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/harbormaster/step/HarbormasterCircleCIBuildStepImplementation.php#L124-L160","documentation":"The CircleCI step stores an API token as a Passphrase credential PHID in its 'token' setting. During execution it loads that credential with PassphraseCredentialQuery (viewer = omnipotent user, needSecrets(true)) and throws when executeOne() returns nothing. Because the viewer is omnipotent, visibility rules are not the cause: the credential PHID is null (step never configured), or the credential no longer loads (deleted, destroyed, or its secret is unavailable).","triggerScenarios":"Running a build whose CircleCI step has an empty/unset 'token' field, or whose selected credential was deleted from Passphrase afterwards. Also occurs when a plan exported/imported between instances keeps a stale credential PHID, or when the credential is of the wrong type so it is excluded by the query.","commonSituations":"Someone cleaned up Passphrase credentials while build plans still referenced them; the step was created via Conduit/CLI without the required 'token' field; the credential was created as a non-token type (the field expects PassphraseTokenCredentialType).","solutions":["Edit the build step in Harbormaster and select a valid Passphrase credential of type 'Token' that provides a token.","If no credential exists, create one in Passphrase containing a CircleCI API token, then re-select it in the step.","Search other build plans for the deleted PHID (harbormaster_buildstep.settings) and update every step that references it.","If the step was created programmatically, re-create it with the 'token' setting populated."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Verify the step's credential loads (with secrets) before starting builds:\n$phid = $step->getSetting('token');\n$ok = (bool)id(new PassphraseCredentialQuery())\n  ->setViewer(PhabricatorUser::getOmnipotentUser())\n  ->withPHIDs(array($phid))\n  ->needSecrets(true)\n  ->executeOne();\nif (!$ok) {\n  // credential missing or unusable - fix the step before building\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Create the CircleCI token credential in Passphrase before configuring the build step.","Never delete credentials that build plans reference; audit plan settings before cleanup.","Use a dedicated, clearly named credential (e.g. 'CircleCI API Token') so it is not mistaken for unused."],"tags":["harbormaster","circleci","passphrase","credential","phabricator"],"backgroundTag":"credential-not-found","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}