{"record":{"id":"d9488cfe9c7dca59","repo":"theonedev/onedev","slug":"invalid-access-token-d9488c","errorCode":null,"errorMessage":"Invalid access token","messagePattern":"Invalid access token","errorType":"http","errorClass":"NotAcceptableException","httpStatus":406,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/TriggerJobResource.java","lineNumber":106,"sourceCode":"    public Long triggerJobViaPost(\n    \t\t@Api(description=\"Path of the project\") @QueryParam(PARAM_PROJECT) @NotEmpty String projectPath, \n    \t\t@Api(description=REF_DESCRIPTION) @QueryParam(PARAM_BRANCH) @Nullable String branch, \n    \t\t@Api(description=REF_DESCRIPTION) @QueryParam(PARAM_TAG) @Nullable String tag, \n    \t\t@QueryParam(PARAM_JOB) @NotEmpty String job,\n\t\t\t@Api(description=ACCESS_TOKEN_DESCRIPTION) @QueryParam(PARAM_ACCESS_TOKEN) @NotEmpty String accessToken, \n    \t\t@Context UriInfo uriInfo) {\n\t\treturn triggerJob(projectPath, branch, tag, job, accessToken, uriInfo);\n    }\n\n    private Long triggerJob(String projectPath, @Nullable String branch, @Nullable String tag, String job,\n\t\t\t\t\t\t\tString accessTokenValue, UriInfo uriInfo) {\n\t\tProject project = projectService.findByPath(projectPath);\n\t\tif (project == null)\n\t\t\tthrow new NotAcceptableException(\"Project not found: \" + projectPath);\n\n\t\tvar accessToken = accessTokenService.findByValue(accessTokenValue);\n\t\tif (accessToken == null)\n\t\t\tthrow new NotAcceptableException(\"Invalid access token\");\n\t\t\n\t\tvar subject = accessToken.asSubject();\n\t\tvar user = SecurityUtils.getUser(subject);\n\t\tThreadContext.bind(subject);\n\t\ttry {\n\t\t\tif (!SecurityUtils.canRunJob(subject, project, job))\t\t\n\t\t\t\tthrow new UnauthorizedException();\n\n\t\t\tif (StringUtils.isNotBlank(branch) && StringUtils.isNotBlank(tag)) \n\t\t\t\tthrow new NotAcceptableException(\"Either branch or tag should be specified, but not both\");\n\t\t\t\n\t\t\tString refName;\n\t\t\tif (branch != null)\n\t\t\t\trefName = GitUtils.branch2ref(branch);\n\t\t\telse if (tag != null)\n\t\t\t\trefName = GitUtils.tag2ref(tag);\n\t\t\telse\n\t\t\t\trefName = GitUtils.branch2ref(project.getDefaultBranch());","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/TriggerJobResource.java#L88-L124","documentation":"After locating the project, triggerJob looks up the supplied access token via accessTokenService.findByValue. If no token matches, NotAcceptableException (406) 'Invalid access token' is thrown. The endpoint relies on an explicit 'access_token' query parameter rather than HTTP auth.","triggerScenarios":"Calling GET/POST /~api/trigger-job without 'access_token' parameter, or with a token that is misspelled, truncated, expired, revoked, or generated by a different OneDev instance.","commonSituations":"Token copied with surrounding whitespace or quotes; old token rotated in the UI but cached in CI variables; using a JWT/OAuth token instead of an OneDev access token; storing token in config that lost the value.","solutions":["Copy a fresh access token from User Profile > Access Tokens and pass it via the access_token query parameter.","Check the token was not rotated/expired/revoked and regenerate if necessary.","Verify the token string is not truncated or wrapped in quotes/whitespace in your CI secret store."],"exampleFix":"// before\ncurl 'http://onedev/~api/trigger-job?project=myorg/myrepo&job=CI'  // no token\n// after\ncurl 'http://onedev/~api/trigger-job?project=myorg/myrepo&job=CI&access_token=YOUR_ONEDEV_TOKEN'","handlingStrategy":"validation","validationCode":"if (!accessToken || accessToken.length < 20)\n  throw new Error('access_token query parameter is missing or malformed');","typeGuard":"function hasToken(params) {\n  return typeof params.access_token === 'string' && params.access_token.trim().length > 0;\n}","tryCatchPattern":null,"preventionTips":["Keep the token in a CI secret and pass it explicitly as access_token.","Regenerate tokens on rotation and update the secret.","Trim whitespace/quotes when copying tokens."],"tags":["rest-api","access-token","authentication","ci-cd","onedev"],"backgroundTag":"invalid-api-key","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}