theonedev/onedev · error · ExplicitException

Invalid access token: {0}

Error message

Invalid access token: {0}

What it means

Thrown by JobAuthorizationContext.getSubject when an access token is supplied (as a job secret reference or literal) but AccessTokenService.findByValue finds no matching token in the database. The token secret resolved via getSecretValue does not correspond to any existing access token. Thrown as ExplicitException with the secret value embedded.

Source

Thrown at server-core/src/main/java/io/onedev/server/job/JobAuthorizationContext.java:67

					JobMatchContext targetContext = new JobMatchContext(request.getTargetProject(), request.getTargetBranch(), null, null);
					return jobMatch.matches(sourceContext) && jobMatch.matches(targetContext);
				} else {
					return false;					
				}
			} else {
				return jobMatch.matches(new JobMatchContext(project, null, commitId, null));
			}
		} else {
			return true;
		}
	}
	
	public Subject getSubject(@Nullable String accessTokenSecret) {
		if (accessTokenSecret != null) {
			String secretValue = getSecretValue(accessTokenSecret);
			var accessToken = OneDev.getInstance(AccessTokenService.class).findByValue(secretValue);
			if (accessToken == null)
				throw new ExplicitException(MessageFormat.format(_T("Invalid access token: {0}"), secretValue));
			return accessToken.asSubject();
		} else {
			return SecurityUtils.asAnonymous();
		}
	}

	public String getSecretValue(String secretName) {
		if (secretName.startsWith(SecretInput.LITERAL_VALUE_PREFIX)) {
			return secretName.substring(SecretInput.LITERAL_VALUE_PREFIX.length());
		} else {
			for (JobSecret secret: project.getHierarchyJobSecrets()) {
				if (secret.getName().equals(secretName)) {
					String authorization = secret.getAuthorization();
					if (authorization == null) {
						return normalizeSecretValue(secret.getValue());
					} else {
						JobMatch jobMatch = JobMatch.parse(authorization, false, false);
						if (request != null) {

View on GitHub (pinned to d44925c47c)

Solutions

1. Verify the access token still exists under user profile > Access Tokens and recreate it if deleted
2. Update the job secret value with the current token
3. Confirm the secret name in the job matches an existing project job secret
4. Check you are pointing at the correct OneDev instance (tokens are instance-local)

Example fix

// before: token deleted
// secret value: "old-token-abc"
// after: regenerate token and update secret
// secret value: "newly-generated-token-xyz"
var token = OneDev.getInstance(AccessTokenService.class).findByValue(secretValue);
if (token == null) throw new ExplicitException("Configure a valid access token in job secrets");

// before running the job, confirm the token exists
var token = OneDev.getInstance(AccessTokenService.class).findByValue(secretValue);
if (token == null) throw new IllegalStateException("Access token referenced by job secret no longer exists");

try {
    var subject = authContext.getSubject(accessTokenSecret);
} catch (ExplicitException e) {
    // prompt admin to regenerate token and update the secret
}

When it happens

Trigger: A job uses a secret whose value is an access token, but the token was deleted, rotated, or mistyped — getSubject(accessTokenSecret) resolves the secret string and fails the DB lookup.

Common situations: Access token revoked/deleted by an admin while jobs still reference it; copy-paste error in a literal token value; token belongs to a different OneDev instance; token regenerated with a new value.

Related errors

• Invalid access token
• Unable to access dependency project '" + dependency.getProje
• Invalid access token
• Invalid access token
• Account is disabled

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/21a58e245965755a. Report an issue: GitHub.