mastra-ai/mastra · error

Repository access did not include a bearer token.

Error message

Repository access did not include a bearer token.

What it means

When pushing a session branch, the route fetches repository access (which should carry an installation bearer token) and immediately asserts access.authorization exists before using its token for git push. This error means the version-control service returned access metadata without credentials — the push cannot authenticate, so it aborts rather than attempting an unauthenticated push.

Source

Thrown at mastracode/factory/src/integrations/github/routes.ts:1551

          return c.json({ error: 'Invalid JSON body' }, 400);
        }
        if (!isValidGitRefSandbox(body.branch)) {
          return c.json({ error: 'Invalid branch' }, 400);
        }
        const branch = body.branch;
        const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
        if (!sessionWorkspace) {
          return c.json({ error: 'Invalid sessionId' }, 400);
        }
        const { workdir, sandbox: sessionSandbox } = sessionWorkspace;

        try {
          return await withSessionOperationLock(sessionWorkspace.session.sessionId, async () => {
            const access = await github.versionControl.getRepositoryAccess({
              orgId,
              repositoryId: project.repository.id,
            });
            if (!access.authorization) throw new Error('Repository access did not include a bearer token.');
            await pushBranch(sessionSandbox, workdir, branch, access.authorization.token, project.repository.slug);
            await emitAudit?.({
              context: loose(c),
              input: {
                action: 'factory.git.push',
                factoryProjectId: project.factoryProjectId,
                projectRepositoryId: project.id,
                targets: [{ type: 'branch', id: branch }],
                metadata: { branch, sessionId: sessionWorkspace.session.sessionId },
              },
            });
            return c.json({ pushed: true, branch });
          });
        } catch (err) {
          return gitErrorResponse(loose(c), err);
        }
      },
    }),

View on GitHub (pinned to 75dd419e61)

Solutions

1. Re-install or repair the GitHub App installation for the org and confirm the repository is in its scope.
2. Check the versionControl access service config so it returns an authorization (token) for installation-scoped repos.
3. Verify the orgId/repositoryId passed to getRepositoryAccess actually map to an installation with content write permission.
4. Wrap the push flow to surface a user-facing 'repository not authorized' state instead of this internal error.

const access = await github.versionControl.getRepositoryAccess({ orgId, repositoryId });
if (!access?.authorization?.token) throw new Error('repository not authorized: no installation token');

function hasAuthorization(a: { authorization?: { token: string } | null }): a is { authorization: { token: string } } {
  return typeof a.authorization?.token === 'string' && a.authorization.token.length > 0;
}

try {
  await pushBranch(sessionSandbox, workdir, branch, access.authorization.token, slug);
} catch (err) {
  if (err instanceof Error && err.message.includes('bearer token')) {
    throw new UnauthorizedError('GitHub installation is missing or lacks access to this repository');
  }
  throw err;
}

When it happens

Trigger: Calling the factory git push route when `github.versionControl.getRepositoryAccess({ orgId, repositoryId })` resolves with `authorization: undefined` — e.g. the GitHub App installation is missing or deauthorized for that repo/org, or the access service is misconfigured to omit tokens.

Common situations: GitHub App installation uninstalled or its permissions revoked; repository not added to the installation's allowed repos; an internal service returning a partial response after a version/contract change.

Related errors

• GitHub OAuth token exchange returned no token: ${data.error_
• GitHub capabilities require an app-installation connection.
• GitHub subscriptions require an authenticated repository ses
• Repository access did not include a bearer token for the Fac
• Failed to load GitHub token status (${res.status})

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/fcaf2b53b3c7c4ae. Report an issue: GitHub.