theonedev/onedev · error · ExplicitException

Unable to access dependency project '" + dependency.getProje

Error message

Unable to access dependency project '" + dependency.getProjectPath() + "': invalid access token

What it means

When a build dependency specifies an access token (dependency.getAccessTokenSecret()), doSubmit resolves the secret's value and looks up a matching access token via accessTokenService.findByValue. If no token matches (deleted, rotated, or wrong secret), the dependency project cannot be accessed and an ExplicitException with 'invalid access token' is thrown.

Source

Thrown at server-core/src/main/java/io/onedev/server/job/DefaultJobService.java:407

					dependence.setDependent(build);
					dependence.setRequireSuccessful(interpolated.isRequireSuccessful());
					dependence.setArtifacts(interpolated.getArtifacts());
					dependence.setDestinationPath(interpolated.getDestinationPath());
					build.getDependencies().add(dependence);
				}
			}
			for (ProjectDependency dependency : build.getJob().getProjectDependencies()) {
				dependency = interpolator.interpolateProperties(dependency);
				Project dependencyProject = projectService.findByPath(dependency.getProjectPath());
				if (dependencyProject == null)
					throw new ExplicitException("Unable to find dependency project: " + dependency.getProjectPath());

				Subject subject;
				if (dependency.getAccessTokenSecret() != null) {
					String secretValue = build.getJobAuthorizationContext().getSecretValue(dependency.getAccessTokenSecret());
					var accessToken = accessTokenService.findByValue(secretValue);
					if (accessToken == null) {
						throw new ExplicitException("Unable to access dependency project '"
								+ dependency.getProjectPath() + "': invalid access token");
					}
					subject = accessToken.asSubject();
				} else {
					subject = SecurityUtils.asAnonymous();
				}

				Build dependencyBuild = dependency.getBuildProvider().getBuild(dependencyProject);
				if (dependencyBuild == null) {
					String errorMessage = String.format("Unable to find dependency build in project '"
							+ dependencyProject.getPath() + "'");
					throw new ExplicitException(errorMessage);
				}

				AccessProject projectPermission = new AccessProject();
				if (!dependencyProject.isPermittedByLoginUser(projectPermission)
						&& !subject.isPermitted(new ProjectPermission(dependencyProject, projectPermission))) {
					throw new ExplicitException("Unable to access dependency build '"

View on GitHub (pinned to d44925c47c)

Solutions

1. Generate a new access token with permission on the dependency project and update the referenced secret's value.
2. Verify the accessTokenSecret name matches an existing secret in the job authorization context.
3. If the token was rotated, update the build spec/secret store with the current token value.
4. If anonymous access suffices, remove the accessTokenSecret field so it falls back to anonymous subject.

Example fix

// before
- projectName: core-lib
  accessTokenSecret: core-lib-token   # token deleted
// after (after creating a new token and secret 'core-lib-token')
- projectName: core-lib
  accessTokenSecret: core-lib-token

String secretValue = jobAuthorizationContext.getSecretValue(dep.getAccessTokenSecret());
if (secretValue == null || accessTokenService.findByValue(secretValue) == null)
  throw new ValidationException("Access token for dependency " + dep.getProjectPath() + " is missing or invalid");

try { jobService.submit(...); } catch (ExplicitException e) { if (e.getMessage().contains("invalid access token")) rotateTokenAndUpdateSecret(); throw e; }

When it happens

Trigger: doSubmit on a build whose projectDependencies define accessTokenSecret pointing to a secret whose value does not correspond to any existing access token in the system.

Common situations: Access token deleted or regenerated by an admin; secret defined in one project but the token belongs to another; the job authorization context cannot decrypt/resolve the secret into a valid token; environment migration losing tokens.

Related errors

• Invalid access token
• Invalid access token
• This build is not authorized to sync to project:
• Invalid access token: {0}
• Invalid access token

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/064d3dddf665a3ae. Report an issue: GitHub.