{"record":{"id":"6074cf938113d81f","repo":"theonedev/onedev","slug":"invalid-access-token-6074cf","errorCode":null,"errorMessage":"Invalid access token","messagePattern":"Invalid access token","errorType":"exception","errorClass":"ExplicitException","httpStatus":null,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/model/Build.java","lineNumber":1073,"sourceCode":"\t}\n\n\tpublic boolean canCreateBranch(String accessTokenSecret, String branchName) {\n\t\tvar project = getProject();\n\t\treturn project.isCommitOnBranch(getCommitId(), project.getDefaultBranch())\n\t\t\t\t|| accessTokenSecret != null && SecurityUtils.canCreateBranch(getAccessToken(accessTokenSecret).asSubject(), project, branchName);\n\t}\n\t\n\tpublic boolean canCreateTag(@Nullable String accessTokenSecret, String tagName) {\n\t\tvar project = getProject();\n\t\treturn project.isCommitOnBranch(getCommitId(), project.getDefaultBranch())\n\t\t\t\t|| accessTokenSecret != null && SecurityUtils.canCreateTag(getAccessToken(accessTokenSecret).asSubject(), project, tagName);\n\t}\n\t\n\tpublic AccessToken getAccessToken(String accessTokenSecret) {\n\t\tString secretValue = getJobAuthorizationContext().getSecretValue(accessTokenSecret);\n\t\tvar accessToken = OneDev.getInstance(AccessTokenService.class).findByValue(secretValue);\n\t\tif (accessToken == null)\n\t\t\tthrow new ExplicitException(\"Invalid access token\");\n\t\treturn accessToken;\n\t}\n\t\n\tpublic boolean canCloseIteration(@Nullable String accessTokenSecret) {\n\t\tvar project = getProject();\n\t\treturn project.isCommitOnBranch(getCommitId(), project.getDefaultBranch())\n\t\t\t\t|| accessTokenSecret != null && SecurityUtils.canManageIssues(getAccessToken(accessTokenSecret).asSubject(), project);\n\t}\n\t\n\tpublic boolean isValid() {\n\t\treturn getGitService().hasObjects(getProject(), ObjectId.fromString(getCommitHash()));\n\t}\n\t\n\t@Nullable\n\tpublic static Build get() {\n\t\tif (!stack.get().isEmpty()) { \n\t\t\treturn stack.get().peek();\n\t\t} else {","sourceCodeStart":1055,"sourceCodeEnd":1091,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/model/Build.java#L1055-L1091","documentation":"Build steps can reference an access token by its secret. Build.getAccessToken resolves the secret's value through the job authorization context and looks it up in AccessTokenService. If no access token exists with that value, ExplicitException 'Invalid access token' is thrown.","triggerScenarios":"A build step/setting references an access token secret whose stored value does not match any token in the database (token deleted, secret edited, wrong secret variable used).","commonSituations":"Administrator deleted or regenerated the access token used by CI job configs; job config points to the wrong secret name; secrets injected by job authorization context changed between builds; copying build configs across projects where the token does not exist.","solutions":["Recreate the access token in Administration > Access Tokens and update the secret referenced by the build","Point the build/job config to an existing valid access token secret","Re-run the build after fixing the secret reference","Audit other jobs referencing the same deleted token"],"exampleFix":"// before\naccessTokenSecret: \"deprecated-ci-token\"  // token deleted\n// after\naccessTokenSecret: \"ci-token\"  // existing token with valid value","handlingStrategy":"validation","validationCode":"AccessToken t = OneDev.getInstance(AccessTokenService.class).findByValue(secretValue); if (t == null) { /* token invalid */ }","typeGuard":null,"tryCatchPattern":"try { var token = build.getAccessToken(secret); ... } catch (ExplicitException e) { failStep(\"Access token misconfigured: \" + e.getMessage()); }","preventionTips":["Do not delete access tokens still referenced by job secrets","Regenerate token values only with config updates in lockstep","Audit job configs for token secret references"],"tags":["authentication","access-token","ci"],"backgroundTag":"authentication-required","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}