opf/openproject · error · Import::JiraClient::ApiError

Invalid API token. Please check your credentials in the conf

Error message

Invalid API token. Please check your credentials in the configuration.

What it means

Import::JiraClient#initialize requires a personal_access_token because every request sends an 'Authorization: Bearer <token>' header. If the token argument is nil it immediately raises ApiError with the 'admin.jira.test.token_error' message — before any network I/O. This is the Jira importer's configuration entry check.

Source

Thrown at app/services/import/jira_client.rb:57

    class ParseError < Error; end

    class ApiError < Error
      attr_reader :status, :response_body

      def initialize(message, status: nil, response_body: nil)
        super(message)
        @status = status
        @response_body = response_body
      end
    end

    HTTP_OPTIONS = {
      open_timeout: 30,
      read_timeout: 30
    }.freeze

    def initialize(url:, personal_access_token:)
      raise ApiError.new(I18n.t(:"admin.jira.test.token_error")) if personal_access_token.nil?

      @url = url.chomp("/")
      @headers = {
        "Accept" => "application/json",
        "Authorization" => "Bearer #{personal_access_token}"
      }
    end

    def mypermissions
      get("/rest/api/2/mypermissions")
    end

    def index_condition_summary
      get("/rest/api/2/index/summary")
    end

    def server_info
      get("/rest/api/2/serverInfo")

View on GitHub (pinned to d9742c43f3)

Solutions

Open Admin → Import → Jira settings, re-enter the API token, save, then use the test-connection action to verify.
If you build the client programmatically, load the token from your credential store/ENV before constructing and fail fast with a clear message if missing.
Confirm the form actually posts the token parameter (check logs/params) after upgrading the admin UI.

Example fix

# before
client = Import::JiraClient.new(url: url, personal_access_token: params[:token])

# after
token = params[:token].presence or raise ArgumentError, 'Jira API token missing'
client = Import::JiraClient.new(url: url, personal_access_token: token)

Defensive patterns

Strategy: validation

Validate before calling

raise ArgumentError, 'Jira API token missing' if token.nil?

Try / catch

begin
  Import::JiraClient.new(url:, personal_access_token: token)
rescue Import::JiraClient::ApiError
  prompt_for_token_reentry
end

Prevention

Preflight-check token presence in the settings controller so the user gets a form error, not a raised ApiError.
Store the token in the credential store and read it at call time instead of round-tripping it through form params.
After every save of Jira settings, run the built-in test connection to fail fast.

When it happens

Trigger: Instantiating Import::JiraClient.new(url: ..., personal_access_token: nil). In the app this happens when the admin Jira import settings were saved without re-entering the token, so the controller passes nil through to the client.

Common situations: Re-saving the Jira settings form: password/token inputs are rendered blank after load (standard Rails security behavior) and if left empty the stored token is not resubmitted, yielding nil; automation scripts that read the token from an unset ENV var; secret stripped between requests.

Related errors

AI-assisted analysis of opf/openproject@d9742c43f3 (2026-08-21). Data as JSON: /api/errors/0db36c9c25fd903a. Report an issue: GitHub.