wpscanteam/wpscan · error · WPScan::Error::InvalidApiToken

The API token provided is invalid

Error message

The API token provided is invalid

What it means

Raised by VulnApi#before_scan (app/controllers/vuln_api.rb:66) when the WPScan API answers the token status check with {'status' => 'forbidden'} after `DB::VulnApi.token = api_token`. The token was transmitted but rejected: wrong value, revoked/regenerated, or a different kind of token (e.g. an enterprise DB token pasted into --api-token).

Source

Thrown at app/controllers/vuln_api.rb:66

             'Has no effect unless --proxy is also set.']
          )
        ]
      end

      def before_scan
        # Already done by Core#before_scan (before the DB update, to fail as early as possible),
        # kept as a safety net in case this controller is used in a chain without Core.
        self.class.validate_api_tokens!

        return setup_enterprise_db if enterprise_db_token

        return unless api_token

        DB::VulnApi.token = api_token

        api_status = DB::VulnApi.status

        raise Error::InvalidApiToken if api_status['status'] == 'forbidden'
        raise Error::ApiLimitReached if api_status['requests_remaining'] == 0
        raise Error::ApiConnectionError, api_status['http_error'] if api_status['http_error']
      end

      def after_scan
        output('status', status: DB::VulnApi.status, api_requests: WPScan.api_requests)
      end

      private

      # @return [ String, nil ] The enterprise DB token (CLI or ENV)
      def enterprise_db_token
        self.class.enterprise_db_token
      end

      # @return [ String, nil ] The API token (CLI or ENV var)
      def api_token
        self.class.api_token

View on GitHub (pinned to 62c9cef471)

Solutions

1. Re-copy the token from https://wpscan.com/profile and re-run, minding quotes and whitespace
2. If set via env var, verify byte-exactness (e.g. echo -n "$WPSCAN_API_TOKEN" | wc -c against the expected length)
3. Make sure you are using the API token, not the enterprise DB token, with --api-token

Example fix

# before
WPSCAN_API_TOKEN='xyz ' wpscan --url http://t   # trailing space from copy-paste
# => The API token provided is invalid

# after
wpscan --url http://t --api-token xyz

# Validate the token with a status call before scanning
WPScan::DB::VulnApi.token = candidate
status = WPScan::DB::VulnApi.status
abort 'bad token' if status['status'] == 'forbidden'

# Guard on the status payload shape before branching
invalid = api_status.is_a?(Hash) && api_status['status'] == 'forbidden'

begin
  scan.run
rescue WPScan::Error::InvalidApiToken
  abort 're-copy the token from wpscan.com/profile'
end

When it happens

Trigger: Running with --api-token TOKEN (or WPSCAN_API_TOKEN) whose value is wrong, truncated by shell quoting, carries trailing whitespace/newline from copy-paste, or was revoked on wpscan.com/profile; also when an enterprise DB token is mistakenly used with --api-token.

Common situations: Copy-paste errors (missing characters, stray spaces); token rotated on the website but stale in CI secrets; CI secret interpolation mangling the value; confusion between the API token and the enterprise DB token.

Related errors

• SAML authentication is required to access this resource. Ple
• SAML authentication is required to access this resource, con
• --api-token and --enterprise-db-token are mutually exclusive
• Your API limit has been reached
• SAML authentication is required to access this resource. Ple

AI-assisted analysis of wpscanteam/wpscan@62c9cef471 (2026-08-21). Data as JSON: /api/errors/49ca1be34d4df66a. Report an issue: GitHub.