theonedev/onedev · error · NotAcceptableException

Invalid access token

Error message

Invalid access token

What it means

RunProjectJobAction.execute looks up the access token by the secret value obtained from the job's accessTokenSecret. If AccessTokenService.findByValue returns null — the secret does not match any token in the target project — it throws NotAcceptableException('Invalid access token').

Source

Thrown at server-core/src/main/java/io/onedev/server/buildspec/job/action/RunProjectJobAction.java:199

		this.accessTokenSecret = accessTokenSecret;
	}
	
	@SuppressWarnings("unused")
	private static List<String> getAccessTokenSecretChoices() {
		return Project.get().getHierarchyJobSecrets()
				.stream().map(it->it.getName()).collect(Collectors.toList());
	}

	@Override
	public void execute(Build build) {
		Project project = getProjectService().findByPath(projectPath);
		if (project == null)
			throw new NotAcceptableException("Project not found: " + projectPath);

		String secretValue = build.getJobAuthorizationContext().getSecretValue(accessTokenSecret);
		var accessToken = getAccessTokenService().findByValue(secretValue);
		if (accessToken == null)
			throw new NotAcceptableException("Invalid access token");
		
		var subject = accessToken.asSubject();
		if (!SecurityUtils.canRunJob(subject, project, jobName))		
			throw new UnauthorizedException();

		var user = SecurityUtils.getUser(subject);
		ThreadContext.bind(subject);
		try {
			String refName;
			if (branch != null) {
				refName = GitUtils.branch2ref(branch);
			} else if (tag != null) {
				refName = GitUtils.tag2ref(tag);
			} else {
				var defaultBranch = project.getDefaultBranch();
				if (defaultBranch == null)
 					throw new NotAcceptableException("No default branch in project: " + project.getPath());
				refName = GitUtils.branch2ref(defaultBranch);

View on GitHub (pinned to d44925c47c)

Solutions

1. Regenerate/create an access token in the target project and update the referenced job secret with its new value.
2. Verify accessTokenSecret names an existing job secret whose value is a valid token for the target project.
3. Ensure the token's owner has permission to run the referenced job (canRunJob) to avoid the follow-on UnauthorizedException.

Example fix

// before: secret points at revoked token
accessTokenSecret: old-deploy-token
// after: new secret holding a live token
accessTokenSecret: deploy-token-2026

// Ensure the job secret resolves to a live token before running
var secret = build.getJobAuthorizationContext().getSecretValue(accessTokenSecret);
if (secret == null || secret.isBlank() || OneDev.getInstance(AccessTokenService.class).findByValue(secret) == null)
    throw new IllegalStateException("No valid access token for secret: " + accessTokenSecret);

try { runProjectJobAction.execute(build); } catch (NotAcceptableException e) { rotateTokenAndRerun(e.getMessage()); }

When it happens

Trigger: Executing a RunProjectJobAction where build.getJobAuthorizationContext().getSecretValue(accessTokenSecret) resolves to a value with no matching access token — the referenced secret is empty, wrong, or points to a deleted/rotated token.

Common situations: The access token was revoked or regenerated after the secret was configured; the job secret name is wrong so a placeholder/empty value is used; token belongs to a different project than the one being targeted; secret never defined in the job's secret settings.

Related errors

• Invalid access token
• Not authenticated
• Project not found:
• Authentication required
• Unable to access dependency project '" + dependency.getProje

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/23a86d6d99216ebf. Report an issue: GitHub.