{"record":{"id":"1f8e62d48b655cfa","repo":"phacility/phabricator","slug":"unable-to-load-api-token-s","errorCode":null,"errorMessage":"Unable to load API token (\"%s\")!","messagePattern":"Unable to load API token \\(\"(.+?)\"\\)!","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/harbormaster/step/HarbormasterBuildkiteBuildStepImplementation.php","lineNumber":143,"sourceCode":"    if ($author_identity) {\n      $data_structure += array(\n        'author' => array(\n          'name' => $author_identity->getIdentityDisplayName(),\n          'email' => $author_identity->getIdentityEmailAddress(),\n        ),\n      );\n    }\n\n    $json_data = phutil_json_encode($data_structure);\n\n    $credential_phid = $this->getSetting('token');\n    $api_token = id(new PassphraseCredentialQuery())\n      ->setViewer($viewer)\n      ->withPHIDs(array($credential_phid))\n      ->needSecrets(true)\n      ->executeOne();\n    if (!$api_token) {\n      throw new Exception(\n        pht(\n          'Unable to load API token (\"%s\")!',\n          $credential_phid));\n    }\n\n    $token = $api_token->getSecret()->openEnvelope();\n\n    $future = id(new HTTPSFuture($uri, $json_data))\n      ->setMethod('POST')\n      ->addHeader('Content-Type', 'application/json')\n      ->addHeader('Accept', 'application/json')\n      ->addHeader('Authorization', \"Bearer {$token}\")\n      ->setTimeout(60);\n\n    $this->resolveFutures(\n      $build,\n      $build_target,\n      array($future));","sourceCodeStart":125,"sourceCodeEnd":161,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/harbormaster/step/HarbormasterBuildkiteBuildStepImplementation.php#L125-L161","documentation":"The Buildkite step loads its API token from a Passphrase credential whose PHID is stored in the step's 'token' setting, queried with needSecrets(true) as the omnipotent user. If no credential loads for that PHID, the step throws before any HTTP call and the build target fails: the stored PHID is empty, wrong, or the credential was deleted.","triggerScenarios":"The step's token setting references a deleted Passphrase credential; the PHID was never set or has a typo; the plan was imported from another instance where that credential PHID does not exist.","commonSituations":"Credential rotation or cleanup without updating the build plan; exporting/importing build plans across instances; a wrong PHID pasted into the step configuration.","solutions":["Create (or locate) the Buildkite API token credential in Passphrase and copy its PHID (PHID-CDTL-...)","Update the Buildkite build step's token setting to that PHID and save the plan","After any credential rotation, smoke-test one build to confirm the plan still resolves the token"],"exampleFix":"# before: step token setting = PHID-CDTL-deletedcredential\n# after: create the credential in Passphrase, then set the Buildkite\n# step token setting to the new credential PHID (PHID-CDTL-...)","handlingStrategy":"validation","validationCode":"$credential = id(new PassphraseCredentialQuery())\n  ->setViewer(PhabricatorUser::getOmnipotentUser())\n  ->withPHIDs(array($credential_phid))\n  ->executeOne();\nif (!$credential) {\n  // fix the step token setting before running builds\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Before deleting or rotating Passphrase credentials, search build plans for the old PHID","Smoke-test one build after every credential rotation","After importing plans across instances, re-bind token settings to local credentials"],"tags":["harbormaster","phabricator","buildkite","credentials","passphrase","api-token"],"backgroundTag":"credential-not-found","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}