What causes "could not find key "oauth_token"" in cli/cli?

Authenticate the host so a token is stored: `gh auth login --hostname `.

could not find key "oauth_token"

Error message

could not find key "oauth_token"

What it means

Returned by `gh config get` when fetching the special key `oauth_token` for a specific host (`--host`) and ActiveToken returns an empty string. Unlike normal keys read from hosts.yml, oauth_token is looked up through the authentication config (keyring-backed token storage or the config file), so this error means gh has no stored credential for that host. It never consults GH_TOKEN/GITHUB_TOKEN for this path, so env-token users also hit it.

Source

Thrown at pkg/cmd/config/get/get.go:60

			if runF != nil {
				return runF(opts)
			}

			return getRun(opts)
		},
	}

	cmd.Flags().StringVarP(&opts.Hostname, "host", "h", "", "Get per-host setting")

	return cmd
}

func getRun(opts *GetOptions) error {
	// search keyring storage when fetching the `oauth_token` value
	if opts.Hostname != "" && opts.Key == "oauth_token" {
		token, _ := opts.Config.Authentication().ActiveToken(opts.Hostname)
		if token == "" {
			return errors.New(`could not find key "oauth_token"`)
		}
		fmt.Fprintf(opts.IO.Out, "%s\n", token)
		return nil
	}

	optionalEntry := opts.Config.GetOrDefault(opts.Hostname, opts.Key)
	if optionalEntry.IsNone() {
		return nonExistentKeyError{key: opts.Key}
	}

	val := optionalEntry.Unwrap().Value
	if val != "" {
		fmt.Fprintf(opts.IO.Out, "%s\n", val)
	}
	return nil
}

type nonExistentKeyError struct {

View on GitHub (pinned to 0eeec0b92e)

Solutions

Authenticate the host so a token is stored: `gh auth login --hostname <host>`.
If you rely on env tokens, read GH_TOKEN/GITHUB_TOKEN directly instead of `gh config get oauth_token`.
Verify the exact host string with `gh auth status` and re-run with the matching --host value.

Example fix

# before
gh config get oauth_token --host ghe.example.com   # error

# after
gh auth login --hostname ghe.example.com
gh config get oauth_token --host ghe.example.com

Defensive patterns

Strategy: validation

Validate before calling

# bash: verify a stored token exists before reading it
if ! gh auth status --hostname "$host" 2>/dev/null | grep -q 'Logged in'; then
  echo "not logged in to $host" >&2; exit 2
fi
token=$(gh config get oauth_token --host "$host")

Try / catch

token=$(gh config get oauth_token --host "$host" 2>&1)
if [[ "$token" == *'could not find key'* ]]; then
  token="${GH_TOKEN:-${GITHUB_TOKEN:-}}"  # fall back to env
fi
[[ -n "$token" ]] || { echo 'no token available' >&2; exit 1; }

Prevention

Prefer `gh auth token --host <host>` which also honors env tokens, over `gh config get oauth_token`.
Run gh auth login --hostname for each host you script against before reading its token.

When it happens

Trigger: Running `gh config get oauth_token --host github.example.com` when the user has never run `gh auth login` against that host, or the keyring entry/config entry for the token is empty/missing.

Common situations: Automation that assumes a stored token but the environment only has GH_TOKEN set (env tokens are not returned here); GHES hosts authenticated via a different mechanism; keyring unavailable or wiped (headless CI, rotated keyrings); typos in the --host value causing a lookup against an unknown host.

Related errors

AI-assisted analysis of cli/cli@0eeec0b92e (2026-08-15). Data as JSON: /api/errors/52fbad0aa4818946. Report an issue: GitHub.