{"record":{"id":"be9a4e7099b3a429","repo":"mislav/hub","slug":"you-must-authorize-your-token-to-access-this-organ","errorCode":null,"errorMessage":"You must authorize your token to access this organization:\\n%s","messagePattern":"You must authorize your token to access this organization:\\\\n(.+?)","errorType":"exception","errorClass":null,"httpStatus":403,"severity":"error","filePath":"github/client.go","lineNumber":1281,"sourceCode":"\t\treturn fmt.Errorf(\"%s\\n%s\", errStr, scopeErr)\n\t}\n\n\treturn errors.New(errStr)\n}\n\n// ValidateGitHubSSO checks for the challenge via `X-Github-Sso` header\nfunc ValidateGitHubSSO(res *http.Response) error {\n\tif res.StatusCode != 403 {\n\t\treturn nil\n\t}\n\n\tsso := res.Header.Get(\"X-Github-Sso\")\n\tif !strings.HasPrefix(sso, \"required; url=\") {\n\t\treturn nil\n\t}\n\n\turl := sso[strings.IndexByte(sso, '=')+1:]\n\treturn fmt.Errorf(\"You must authorize your token to access this organization:\\n%s\", url)\n}\n\n// ValidateSufficientOAuthScopes warns about insufficient OAuth scopes\nfunc ValidateSufficientOAuthScopes(res *http.Response) error {\n\tif res.StatusCode != 404 && res.StatusCode != 403 {\n\t\treturn nil\n\t}\n\n\tneedScopes := newScopeSet(res.Header.Get(\"X-Accepted-Oauth-Scopes\"))\n\tif len(needScopes) == 0 && isGistWrite(res.Request) {\n\t\t// compensate for a GitHub bug: gist APIs omit proper `X-Accepted-Oauth-Scopes` in responses\n\t\tneedScopes = newScopeSet(\"gist\")\n\t}\n\n\thaveScopes := newScopeSet(res.Header.Get(\"X-Oauth-Scopes\"))\n\tif len(needScopes) == 0 || needScopes.Intersects(haveScopes) {\n\t\treturn nil\n\t}","sourceCodeStart":1263,"sourceCodeEnd":1299,"githubUrl":"https://github.com/mislav/hub/blob/5c547ed804368763064e51f3990851e267e88edd/github/client.go#L1263-L1299","documentation":"ValidateGitHubSSO inspects the X-Github-Sso response header. When it starts with `required; url=`, the token is not SSO-authorized for the target organization, and the validator returns this error embedding the authorization URL. SAML SSO-enabled orgs reject tokens that haven't been explicitly authorized per-token, per-org.","triggerScenarios":"Any API call to an org resource on a SAML SSO-enabled organization where the personal access token has not been authorized for that org; GitHub responds 403/404 with the `required; url=<sso_url>` header value.","commonSituations":"Company orgs that enabled SAML SSO after the token was created; automation/CI using a long-lived PAT authorized for other orgs but not this one; new org members whose tokens were never authorized.","solutions":["Visit the URL in the error message while logged into GitHub and click 'Authorize' for the organization.","Alternatively authorize manually: Settings → Developer settings → Personal access tokens → Configure SSO → Authorize next to the org.","If automating, use a GitHub App or fine-grained token, which bypasses per-token SSO authorization.","Re-run the failed operation after authorization; the header should disappear."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"req, _ := http.NewRequest(\"GET\", \"https://api.github.com/orgs/\"+org, nil)\nreq.Header.Set(\"Authorization\", \"Bearer \"+token)\nres, _ := http.DefaultClient.Do(req)\nif sso := res.Header.Get(\"X-Github-Sso\"); strings.HasPrefix(sso, \"required; url=\") {\n    return fmt.Errorf(\"token not SSO-authorized for %s: visit %s\", org, sso[strings.IndexByte(sso,'=')+1:])\n}","typeGuard":null,"tryCatchPattern":"if strings.Contains(err.Error(), \"authorize your token to access this organization\") {\n    url := extractSSOURL(err.Error())\n    fmt.Fprintf(os.Stderr, \"Open %s to authorize your token, then retry.\\n\", url)\n    return err\n}","preventionTips":["Authorize the token for each SAML SSO org via Settings → Developer settings → Configure SSO.","When an org enables SSO, re-authorize all existing automation tokens.","Use a GitHub App installation token for CI — no per-token SSO step required.","Probe org access (GET /orgs/{org}) before batch operations to surface SSO needs early."],"tags":["github-api","saml-sso","token-authorization"],"backgroundTag":"github-sso-authorization-required","analyzedSha":"5c547ed804368763064e51f3990851e267e88edd","analyzedAt":"2026-09-01T03:34:15.525Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}