{"record":{"id":"23a86d6d99216ebf","repo":"theonedev/onedev","slug":"invalid-access-token","errorCode":null,"errorMessage":"Invalid access token","messagePattern":"Invalid access token","errorType":"http","errorClass":"NotAcceptableException","httpStatus":400,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/buildspec/job/action/RunProjectJobAction.java","lineNumber":199,"sourceCode":"\t\tthis.accessTokenSecret = accessTokenSecret;\n\t}\n\t\n\t@SuppressWarnings(\"unused\")\n\tprivate static List<String> getAccessTokenSecretChoices() {\n\t\treturn Project.get().getHierarchyJobSecrets()\n\t\t\t\t.stream().map(it->it.getName()).collect(Collectors.toList());\n\t}\n\n\t@Override\n\tpublic void execute(Build build) {\n\t\tProject project = getProjectService().findByPath(projectPath);\n\t\tif (project == null)\n\t\t\tthrow new NotAcceptableException(\"Project not found: \" + projectPath);\n\n\t\tString secretValue = build.getJobAuthorizationContext().getSecretValue(accessTokenSecret);\n\t\tvar accessToken = getAccessTokenService().findByValue(secretValue);\n\t\tif (accessToken == null)\n\t\t\tthrow new NotAcceptableException(\"Invalid access token\");\n\t\t\n\t\tvar subject = accessToken.asSubject();\n\t\tif (!SecurityUtils.canRunJob(subject, project, jobName))\t\t\n\t\t\tthrow new UnauthorizedException();\n\n\t\tvar user = SecurityUtils.getUser(subject);\n\t\tThreadContext.bind(subject);\n\t\ttry {\n\t\t\tString refName;\n\t\t\tif (branch != null) {\n\t\t\t\trefName = GitUtils.branch2ref(branch);\n\t\t\t} else if (tag != null) {\n\t\t\t\trefName = GitUtils.tag2ref(tag);\n\t\t\t} else {\n\t\t\t\tvar defaultBranch = project.getDefaultBranch();\n\t\t\t\tif (defaultBranch == null)\n \t\t\t\t\tthrow new NotAcceptableException(\"No default branch in project: \" + project.getPath());\n\t\t\t\trefName = GitUtils.branch2ref(defaultBranch);","sourceCodeStart":181,"sourceCodeEnd":217,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/buildspec/job/action/RunProjectJobAction.java#L181-L217","documentation":"RunProjectJobAction.execute looks up the access token by the secret value obtained from the job's accessTokenSecret. If AccessTokenService.findByValue returns null — the secret does not match any token in the target project — it throws NotAcceptableException('Invalid access token').","triggerScenarios":"Executing a RunProjectJobAction where build.getJobAuthorizationContext().getSecretValue(accessTokenSecret) resolves to a value with no matching access token — the referenced secret is empty, wrong, or points to a deleted/rotated token.","commonSituations":"The access token was revoked or regenerated after the secret was configured; the job secret name is wrong so a placeholder/empty value is used; token belongs to a different project than the one being targeted; secret never defined in the job's secret settings.","solutions":["Regenerate/create an access token in the target project and update the referenced job secret with its new value.","Verify accessTokenSecret names an existing job secret whose value is a valid token for the target project.","Ensure the token's owner has permission to run the referenced job (canRunJob) to avoid the follow-on UnauthorizedException."],"exampleFix":"// before: secret points at revoked token\naccessTokenSecret: old-deploy-token\n// after: new secret holding a live token\naccessTokenSecret: deploy-token-2026","handlingStrategy":"validation","validationCode":"// Ensure the job secret resolves to a live token before running\nvar secret = build.getJobAuthorizationContext().getSecretValue(accessTokenSecret);\nif (secret == null || secret.isBlank() || OneDev.getInstance(AccessTokenService.class).findByValue(secret) == null)\n    throw new IllegalStateException(\"No valid access token for secret: \" + accessTokenSecret);","typeGuard":null,"tryCatchPattern":"try { runProjectJobAction.execute(build); } catch (NotAcceptableException e) { rotateTokenAndRerun(e.getMessage()); }","preventionTips":["Rotate tokens on a schedule and update the job secret immediately.","Name job secrets clearly and keep accessTokenSecret pointing at the current one.","Verify token owner permissions cover canRunJob on the target project."],"tags":["access-token","authentication","runtime","onedev"],"backgroundTag":"authentication-required","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}