{"record":{"id":"960b2632feab1a71","repo":"SonarSource/sonarqube","slug":"token-doesn-t-exist","errorCode":null,"errorMessage":"Token doesn't exist","messagePattern":"Token doesn't exist","errorType":"exception","errorClass":"NotFoundException","httpStatus":404,"severity":"error","filePath":"server/sonar-webserver-auth/src/main/java/org/sonar/server/usertoken/UserTokenAuthentication.java","lineNumber":120,"sourceCode":"        throw AuthenticationException.newBuilder()\n          .setSource(AuthenticationEvent.Source.local(AuthenticationEvent.Method.SONARQUBE_TOKEN))\n          .setMessage(\"User doesn't exist\")\n          .build();\n      }\n      request.setAttribute(ACCESS_LOG_TOKEN_NAME, userToken.getName());\n      return new UserAuthResult(userDto, userToken, UserAuthResult.AuthType.TOKEN);\n    } catch (NotFoundException | IllegalStateException exception) {\n      throw AuthenticationException.newBuilder()\n        .setSource(AuthenticationEvent.Source.local(AuthenticationEvent.Method.SONARQUBE_TOKEN))\n        .setMessage(exception.getMessage())\n        .build();\n    }\n  }\n\n  private UserTokenDto authenticate(String token) {\n    UserTokenDto userToken = getUserToken(token);\n    if (userToken == null) {\n      throw new NotFoundException(\"Token doesn't exist\");\n    }\n    if (userToken.isExpired()) {\n      throw new IllegalStateException(\"The token expired on \" + formatDateTime(userToken.getExpirationDate()));\n    }\n    userLastConnectionDatesUpdater.updateLastConnectionDateIfNeeded(userToken);\n    return userToken;\n  }\n\n  @Nullable\n  public UserTokenDto getUserToken(String token) {\n    try (DbSession dbSession = dbClient.openSession(false)) {\n      return dbClient.userTokenDao().selectByTokenHash(dbSession, tokenGenerator.hash(token));\n    }\n  }\n}\n","sourceCodeStart":102,"sourceCodeEnd":136,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-auth/src/main/java/org/sonar/server/usertoken/UserTokenAuthentication.java#L102-L136","documentation":"UserTokenAuthentication.authenticate(token) looks up the supplied token in the database. If getUserToken returns null, meaning no row matches the presented token, it throws NotFoundException('Token doesn't exist') so the request fails as unauthenticated with a resource-not-found style error.","triggerScenarios":"An HTTP request authenticated with a user token value that does not exist in the sonar_user_token table — typically a mistyped, revoked, deleted, or fabricated token, or a token from a different SonarQube instance.","commonSituations":"Rotating tokens in CI (old token deleted while pipeline still references it); copying tokens between environments (staging vs production); typos or whitespace in stored secrets.","solutions":["Generate a new token in SonarQube (My Account > Security) and update the credential store/pipeline secret","Check the token wasn't deleted or the user deactivated (Admin > Security > Users/Token list)","Verify you are calling the correct SonarQube instance the token was issued for","Trim accidental whitespace/newlines when injecting the token from env vars"],"exampleFix":"// before\ncurl -H \"Authorization: Bearer ${SONAR_TOKEN_OLD}\" http://sonar/api/...  # token deleted\n// after\ncurl -H \"Authorization: Bearer ${SONAR_TOKEN_NEW}\" http://sonar/api/...","handlingStrategy":"try-catch","validationCode":"// guard before use: non-empty token and correct instance\nif (token == null || token.isBlank()) throw new IllegalArgumentException('SONAR_TOKEN is empty or missing');","typeGuard":"null","tryCatchPattern":"try {\n  await sonarRequest(token);\n} catch (err) {\n  if (err.response?.status === 404) {\n    // token not found: regenerate and update secret store\n  } else throw err;\n}","preventionTips":["Store tokens in a secret manager and sync them to all SonarQube instances used","Track token deletions/revocations (audit logs) against CI consumers","Never copy-paste tokens across staging/production without regenerating","Document token ownership so pipelines can be updated on rotation"],"tags":["authentication","token-not-found","sonarqube"],"backgroundTag":"record-not-found","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}