{"record":{"id":"52fbad0aa4818946","repo":"cli/cli","slug":"could-not-find-key-oauth-token","errorCode":null,"errorMessage":"could not find key \"oauth_token\"","messagePattern":"could not find key \"oauth_token\"","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cmd/config/get/get.go","lineNumber":60,"sourceCode":"\t\t\tif runF != nil {\n\t\t\t\treturn runF(opts)\n\t\t\t}\n\n\t\t\treturn getRun(opts)\n\t\t},\n\t}\n\n\tcmd.Flags().StringVarP(&opts.Hostname, \"host\", \"h\", \"\", \"Get per-host setting\")\n\n\treturn cmd\n}\n\nfunc getRun(opts *GetOptions) error {\n\t// search keyring storage when fetching the `oauth_token` value\n\tif opts.Hostname != \"\" && opts.Key == \"oauth_token\" {\n\t\ttoken, _ := opts.Config.Authentication().ActiveToken(opts.Hostname)\n\t\tif token == \"\" {\n\t\t\treturn errors.New(`could not find key \"oauth_token\"`)\n\t\t}\n\t\tfmt.Fprintf(opts.IO.Out, \"%s\\n\", token)\n\t\treturn nil\n\t}\n\n\toptionalEntry := opts.Config.GetOrDefault(opts.Hostname, opts.Key)\n\tif optionalEntry.IsNone() {\n\t\treturn nonExistentKeyError{key: opts.Key}\n\t}\n\n\tval := optionalEntry.Unwrap().Value\n\tif val != \"\" {\n\t\tfmt.Fprintf(opts.IO.Out, \"%s\\n\", val)\n\t}\n\treturn nil\n}\n\ntype nonExistentKeyError struct {","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/cli/cli/blob/0eeec0b92edbe70199f9768522f831d3534f41ad/pkg/cmd/config/get/get.go#L42-L78","documentation":"Returned by `gh config get` when fetching the special key `oauth_token` for a specific host (`--host`) and ActiveToken returns an empty string. Unlike normal keys read from hosts.yml, oauth_token is looked up through the authentication config (keyring-backed token storage or the config file), so this error means gh has no stored credential for that host. It never consults GH_TOKEN/GITHUB_TOKEN for this path, so env-token users also hit it.","triggerScenarios":"Running `gh config get oauth_token --host github.example.com` when the user has never run `gh auth login` against that host, or the keyring entry/config entry for the token is empty/missing.","commonSituations":"Automation that assumes a stored token but the environment only has GH_TOKEN set (env tokens are not returned here); GHES hosts authenticated via a different mechanism; keyring unavailable or wiped (headless CI, rotated keyrings); typos in the --host value causing a lookup against an unknown host.","solutions":["Authenticate the host so a token is stored: `gh auth login --hostname <host>`.","If you rely on env tokens, read GH_TOKEN/GITHUB_TOKEN directly instead of `gh config get oauth_token`.","Verify the exact host string with `gh auth status` and re-run with the matching --host value."],"exampleFix":"# before\ngh config get oauth_token --host ghe.example.com   # error\n\n# after\ngh auth login --hostname ghe.example.com\ngh config get oauth_token --host ghe.example.com","handlingStrategy":"validation","validationCode":"# bash: verify a stored token exists before reading it\nif ! gh auth status --hostname \"$host\" 2>/dev/null | grep -q 'Logged in'; then\n  echo \"not logged in to $host\" >&2; exit 2\nfi\ntoken=$(gh config get oauth_token --host \"$host\")","typeGuard":null,"tryCatchPattern":"token=$(gh config get oauth_token --host \"$host\" 2>&1)\nif [[ \"$token\" == *'could not find key'* ]]; then\n  token=\"${GH_TOKEN:-${GITHUB_TOKEN:-}}\"  # fall back to env\nfi\n[[ -n \"$token\" ]] || { echo 'no token available' >&2; exit 1; }","preventionTips":["Prefer `gh auth token --host <host>` which also honors env tokens, over `gh config get oauth_token`.","Run gh auth login --hostname for each host you script against before reading its token."],"tags":["cli","config","authentication","token","keyring"],"backgroundTag":null,"analyzedSha":"0eeec0b92edbe70199f9768522f831d3534f41ad","analyzedAt":"2026-08-15T12:31:05.478Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}