You must authorize your token to access this organization:\n

Error message

You must authorize your token to access this organization:\n%s

What it means

ValidateGitHubSSO inspects the X-Github-Sso response header. When it starts with `required; url=`, the token is not SSO-authorized for the target organization, and the validator returns this error embedding the authorization URL. SAML SSO-enabled orgs reject tokens that haven't been explicitly authorized per-token, per-org.

Source

Thrown at github/client.go:1281

		return fmt.Errorf("%s\n%s", errStr, scopeErr)
	}

	return errors.New(errStr)
}

// ValidateGitHubSSO checks for the challenge via `X-Github-Sso` header
func ValidateGitHubSSO(res *http.Response) error {
	if res.StatusCode != 403 {
		return nil
	}

	sso := res.Header.Get("X-Github-Sso")
	if !strings.HasPrefix(sso, "required; url=") {
		return nil
	}

	url := sso[strings.IndexByte(sso, '=')+1:]
	return fmt.Errorf("You must authorize your token to access this organization:\n%s", url)
}

// ValidateSufficientOAuthScopes warns about insufficient OAuth scopes
func ValidateSufficientOAuthScopes(res *http.Response) error {
	if res.StatusCode != 404 && res.StatusCode != 403 {
		return nil
	}

	needScopes := newScopeSet(res.Header.Get("X-Accepted-Oauth-Scopes"))
	if len(needScopes) == 0 && isGistWrite(res.Request) {
		// compensate for a GitHub bug: gist APIs omit proper `X-Accepted-Oauth-Scopes` in responses
		needScopes = newScopeSet("gist")
	}

	haveScopes := newScopeSet(res.Header.Get("X-Oauth-Scopes"))
	if len(needScopes) == 0 || needScopes.Intersects(haveScopes) {
		return nil
	}

View on GitHub (pinned to 5c547ed804)

Solutions

Visit the URL in the error message while logged into GitHub and click 'Authorize' for the organization.
Alternatively authorize manually: Settings → Developer settings → Personal access tokens → Configure SSO → Authorize next to the org.
If automating, use a GitHub App or fine-grained token, which bypasses per-token SSO authorization.
Re-run the failed operation after authorization; the header should disappear.

Defensive patterns

Strategy: try-catch

Validate before calling

req, _ := http.NewRequest("GET", "https://api.github.com/orgs/"+org, nil)
req.Header.Set("Authorization", "Bearer "+token)
res, _ := http.DefaultClient.Do(req)
if sso := res.Header.Get("X-Github-Sso"); strings.HasPrefix(sso, "required; url=") {
    return fmt.Errorf("token not SSO-authorized for %s: visit %s", org, sso[strings.IndexByte(sso,'=')+1:])
}

Try / catch

if strings.Contains(err.Error(), "authorize your token to access this organization") {
    url := extractSSOURL(err.Error())
    fmt.Fprintf(os.Stderr, "Open %s to authorize your token, then retry.\n", url)
    return err
}

Prevention

Authorize the token for each SAML SSO org via Settings → Developer settings → Configure SSO.
When an org enables SSO, re-authorize all existing automation tokens.
Use a GitHub App installation token for CI — no per-token SSO step required.
Probe org access (GET /orgs/{org}) before batch operations to surface SSO needs early.

When it happens

Trigger: Any API call to an org resource on a SAML SSO-enabled organization where the personal access token has not been authorized for that org; GitHub responds 403/404 with the `required; url=<sso_url>` header value.

Common situations: Company orgs that enabled SAML SSO after the token was created; automation/CI using a long-lived PAT authorized for other orgs but not this one; new org members whose tokens were never authorized.

Related errors

AI-assisted analysis of mislav/hub@5c547ed804 (2026-09-01). Data as JSON: /api/errors/be9a4e7099b3a429. Report an issue: GitHub.