theonedev/onedev · error · ExplicitException

Invalid access token

Error message

Invalid access token

What it means

Build steps can reference an access token by its secret. Build.getAccessToken resolves the secret's value through the job authorization context and looks it up in AccessTokenService. If no access token exists with that value, ExplicitException 'Invalid access token' is thrown.

Source

Thrown at server-core/src/main/java/io/onedev/server/model/Build.java:1073

	}

	public boolean canCreateBranch(String accessTokenSecret, String branchName) {
		var project = getProject();
		return project.isCommitOnBranch(getCommitId(), project.getDefaultBranch())
				|| accessTokenSecret != null && SecurityUtils.canCreateBranch(getAccessToken(accessTokenSecret).asSubject(), project, branchName);
	}
	
	public boolean canCreateTag(@Nullable String accessTokenSecret, String tagName) {
		var project = getProject();
		return project.isCommitOnBranch(getCommitId(), project.getDefaultBranch())
				|| accessTokenSecret != null && SecurityUtils.canCreateTag(getAccessToken(accessTokenSecret).asSubject(), project, tagName);
	}
	
	public AccessToken getAccessToken(String accessTokenSecret) {
		String secretValue = getJobAuthorizationContext().getSecretValue(accessTokenSecret);
		var accessToken = OneDev.getInstance(AccessTokenService.class).findByValue(secretValue);
		if (accessToken == null)
			throw new ExplicitException("Invalid access token");
		return accessToken;
	}
	
	public boolean canCloseIteration(@Nullable String accessTokenSecret) {
		var project = getProject();
		return project.isCommitOnBranch(getCommitId(), project.getDefaultBranch())
				|| accessTokenSecret != null && SecurityUtils.canManageIssues(getAccessToken(accessTokenSecret).asSubject(), project);
	}
	
	public boolean isValid() {
		return getGitService().hasObjects(getProject(), ObjectId.fromString(getCommitHash()));
	}
	
	@Nullable
	public static Build get() {
		if (!stack.get().isEmpty()) { 
			return stack.get().peek();
		} else {

View on GitHub (pinned to d44925c47c)

Solutions

1. Recreate the access token in Administration > Access Tokens and update the secret referenced by the build
2. Point the build/job config to an existing valid access token secret
3. Re-run the build after fixing the secret reference
4. Audit other jobs referencing the same deleted token

Example fix

// before
accessTokenSecret: "deprecated-ci-token"  // token deleted
// after
accessTokenSecret: "ci-token"  // existing token with valid value

AccessToken t = OneDev.getInstance(AccessTokenService.class).findByValue(secretValue); if (t == null) { /* token invalid */ }

try { var token = build.getAccessToken(secret); ... } catch (ExplicitException e) { failStep("Access token misconfigured: " + e.getMessage()); }

When it happens

Trigger: A build step/setting references an access token secret whose stored value does not match any token in the database (token deleted, secret edited, wrong secret variable used).

Common situations: Administrator deleted or regenerated the access token used by CI job configs; job config points to the wrong secret name; secrets injected by job authorization context changed between builds; copying build configs across projects where the token does not exist.

Related errors

• Unable to access dependency project '" + dependency.getProje
• Invalid access token
• This build is not authorized to sync to project:
• Invalid access token: {0}
• Invalid access token

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/6074cf938113d81f. Report an issue: GitHub.