{"record":{"id":"e5244a0514d31622","repo":"infiniflow/ragflow","slug":"github-credential-appears-to-be-invalid-or-expired","errorCode":null,"errorMessage":"GitHub credential appears to be invalid or expired (HTTP 401).","messagePattern":"GitHub credential appears to be invalid or expired \\(HTTP 401\\)\\.","errorType":"validation","errorClass":"CredentialExpiredError","httpStatus":null,"severity":"critical","filePath":"common/data_source/github/connector.py","lineNumber":742,"sourceCode":"                            \"authorizing-a-personal-access-token-for-use-with-saml-single-sign-on\"\n                        )\n                        raise ConnectorValidationError(\n                            f\"Your GitHub token is missing authorization to access the `{self.repo_owner}` organization. Please follow the guide to authorize your token: {SSO_GUIDE_LINK}\"\n                        )\n                    # If not an org, try as a user\n                    user = self.github_client.get_user(self.repo_owner)\n\n                    # Check if we can access any repos\n                    total_count = user.get_repos().totalCount\n                    if total_count == 0:\n                        raise ConnectorValidationError(f\"Found no repos for user: {self.repo_owner}. Does the credential have the right scopes?\")\n\n        except RateLimitExceededException:\n            raise UnexpectedValidationError(\"Validation failed due to GitHub rate-limits being exceeded. Please try again later.\")\n\n        except GithubException as e:\n            if e.status == 401:\n                raise CredentialExpiredError(\"GitHub credential appears to be invalid or expired (HTTP 401).\")\n            elif e.status == 403:\n                raise InsufficientPermissionsError(\"Your GitHub token does not have sufficient permissions for this repository (HTTP 403).\")\n            elif e.status == 404:\n                if self.repositories:\n                    if \",\" in self.repositories:\n                        raise ConnectorValidationError(f\"None of the specified GitHub repositories could be found for owner: {self.repo_owner}\")\n                    else:\n                        raise ConnectorValidationError(f\"GitHub repository not found with name: {self.repo_owner}/{self.repositories}\")\n                else:\n                    raise ConnectorValidationError(f\"GitHub user or organization not found: {self.repo_owner}\")\n            else:\n                raise ConnectorValidationError(f\"Unexpected GitHub error (status={e.status}): {e.data}\")\n\n        except Exception as exc:\n            raise Exception(f\"Unexpected error during GitHub settings validation: {exc}\")\n\n    def validate_checkpoint_json(self, checkpoint_json: str) -> GithubConnectorCheckpoint:\n        return GithubConnectorCheckpoint.model_validate_json(checkpoint_json)","sourceCodeStart":724,"sourceCodeEnd":760,"githubUrl":"https://github.com/infiniflow/ragflow/blob/554fb1133ac3861732235ad9c377eb5e0a770665/common/data_source/github/connector.py#L724-L760","documentation":"CredentialExpiredError raised in the GithubException handler for HTTP 401. GitHub returns 401 when the token is bad, revoked, or expired, so the connector maps it to a credential-lifetime error rather than a config error, letting the system mark the credential for re-authentication.","triggerScenarios":"Any API probe in validate_connector_settings() (get_repo, get_contents, get_organization, get_user) returns 401 Bad credentials — e.g. deleted/rotated PAT or expired GitHub App token.","commonSituations":"User regenerated their PAT after saving it; org enforced token expiration (90-day policies) and it lapsed; GitHub App installation token past 1 hour; trailing whitespace/format corruption of the stored token.","solutions":["Generate a new access token and re-save the credential.","If using a GitHub App, ensure token refresh logic runs (installation tokens expire hourly).","Re-run validate_connector_settings() after updating to confirm a clean pass."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try:\n    connector.validate_connector_settings()\nexcept CredentialExpiredError:\n    mark_credential_for_reauth(connector)  # prompt user; do not auto-retry","preventionTips":["Rotate tokens before org-enforced expiration dates (set a renewal reminder for 90-day PATs).","For GitHub Apps, implement installation-token refresh (1h lifetime) instead of storing static tokens."],"tags":["github","credentials","expired","authentication","http-401"],"backgroundTag":null,"analyzedSha":"554fb1133ac3861732235ad9c377eb5e0a770665","analyzedAt":"2026-08-15T09:20:16.380Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}