401 Error at every turn

[ZackPlauche]

Describe the bug

gh version 2.59.0 (2024-10-16)
https://github.com/cli/cli/releases/tag/v2.59.0

Often when trying to do something with gh related to a repo I continue to get the following error:

> gh browse
unable to determine base repository: HTTP 401: Bad credentials (https://api.github.com/graphql)
Try authenticating with:  gh auth login

I'm on Windows 11 commandline and keep having to do:

1. set GITHUB_TOKEN= to clear it
2. Login with gh auth login (annoyingly)
3. Go through the whole process
4. It's fixed for a little while
5. Not much long after it's an issue again.

I've done this multiple times for different projects, and just now again today within less than an hour.

Steps to reproduce the behavior

It happens after opening another project, or a new terminal not that long after I JUST authenticated.

Expected vs actual behavior

I would expect me to just login once and NOT have to keep logging in every single day or multiple times a day.

Logs

Paste the activity from your command line. Redact if needed.

[williammartin]

If it's happening when you're opening a new terminal, and you're having to set GITHUB_TOKEN= to clear it out, you probably have something in your shell startup scripts that is setting GITHUB_TOKEN.

That said, I wouldn't expect you need to auth login each time after clearing the environment variable. Can you provide the output of gh auth status before steps 1, 2, and 3. Thanks.

Also, where is this terminal? Is it inside an editor? What do you mean when you say "It happens after opening another project". What does opening mean in this context?

[ZackPlauche]

@williammartin Right, so I use VSCode and just recently cursor.sh (VSCode fork project) and when I say opening another project I mean switching opening a new workspace / project folder. That parts not consistent though. The consistent part is that it happens often haha.

Yep, just happened again on not a new project... I did this literally yesterday:

gh auth status

  X Failed to log in to github.com using token (GITHUB_TOKEN)
  - Active account: true
  - The token in GITHUB_TOKEN is invalid.

  ✓ Logged in to github.com account ZackPlauche (keyring)
  - Active account: false
  - Git operations protocol: https
  - Token: gho_************************************
  - Token scopes: 'gist', 'read:org', 'repo', 'workflow'

It says "logged in to github.com account" with a checkmark but if I run something as simple as gh browse it throws the same auth error :/

gh browse
unable to determine base repository: HTTP 401: Bad credentials (https://api.github.com/graphql)
Try authenticating with:  gh auth login

I just opened the project again today and logged in.

Just deleted the current token and logged in again and it said this:

gh auth login
? Where do you use GitHub? GitHub.com
? What is your preferred protocol for Git operations on this host? HTTPS
? Authenticate Git with your GitHub credentials? Yes
? How would you like to authenticate GitHub CLI? Login with a web browser

! First copy your one-time code: ****-****
Press Enter to open https://github.com/login/device in your browser... 
✓ Authentication complete.
- gh config set -h github.com git_protocol https
✓ Configured git protocol
✓ Logged in as ZackPlauche
! You were already logged in to this account

The line You were already logged in to this account is confusing.

Also just ran gh auth status again and it's not even showing the token...

gh auth status
github.com
  ✓ Logged in to github.com account ZackPlauche (keyring)
  - Active account: true
  - Git operations protocol: https
  - Token: gho_************************************
  - Token scopes: 'gist', 'read:org', 'repo', 'workflow'

[ZackPlauche]

Update, after my last comment, I just closed and opened the editor again and it's showing the invalid GITHUB_TOKEN message again after running gh auth status. But still says logged in 🤷‍♂️

gh auth status
github.com
  X Failed to log in to github.com using token (GITHUB_TOKEN)
  - Active account: true
  - The token in GITHUB_TOKEN is invalid.

  ✓ Logged in to github.com account ZackPlauche (keyring)
  - Active account: false
  - Git operations protocol: https
  - Token: gho_************************************
  - Token scopes: 'gist', 'read:org', 'repo', 'workflow'

[williammartin]

Right so when GITHUB_TOKEN is set, gh will always use that to authenticate with github.com. When you open a new project in VSCode, it's going to open new terminal, just like you doing it manually. So something is setting the GITHUB_TOKEN environment variable and it's not setting the value to an actually valid token.

After you unset GITHUB_TOKEN you shouldn't need to auth login again, it'll just start using the other token listed in gh auth status here:

  ✓ Logged in to github.com account ZackPlauche (keyring)
  - Active account: false
  - Git operations protocol: https
  - Token: gho_************************************
  - Token scopes: 'gist', 'read:org', 'repo', 'workflow'

I think something that would make this clearer is if we updated this to say something like:

  ✓ Logged in to github.com account ZackPlauche (keyring)
  - Superseded by GITHUB_TOKEN environment variable
  - Active account: false
  - Git operations protocol: https
  - Token: gho_************************************
  - Token scopes: 'gist', 'read:org', 'repo', 'workflow'

I suggest that you grep your shell startup files for GITHUB_TOKEN.

[williammartin]

I also think that we could update this message:

unable to determine base repository: HTTP 401: Bad credentials (https://api.github.com/graphql)
Try authenticating with:  gh auth login

So that if the invalid token is coming from GITHUB_TOKEN env var that we don't recommend trying to log in but to fix the value of your token.

[ZackPlauche]

Right so when GITHUB_TOKEN is set, gh will always use that to authenticate with github.com. When you open a new project in VSCode, it's going to open new terminal, just like you doing it manually. So something is setting the GITHUB_TOKEN environment variable and it's not setting the value to an actually valid token.

After you unset GITHUB_TOKEN you shouldn't need to auth login again, it'll just start using the other token listed in gh auth status here:

  ✓ Logged in to github.com account ZackPlauche (keyring)
  - Active account: false
  - Git operations protocol: https
  - Token: gho_************************************
  - Token scopes: 'gist', 'read:org', 'repo', 'workflow'

I think something that would make this clearer is if we updated this to say something like:

  ✓ Logged in to github.com account ZackPlauche (keyring)
  - Superseded by GITHUB_TOKEN environment variable
  - Active account: false
  - Git operations protocol: https
  - Token: gho_************************************
  - Token scopes: 'gist', 'read:org', 'repo', 'workflow'

I suggest that you grep your shell startup files for GITHUB_TOKEN.

Yeah so unsetting the github token worked. I'm not quite sure how to grep for what's setting it but unsetting is good enough for now lol.

[williammartin]

Yeah so unsetting the github token worked. I'm not quite sure how to grep for what's setting it but unsetting is good enough for now lol.

Maybe something like grep -d skip "GITHUB_TOKEN" ~/*.

[ZackPlauche]

Yeah so unsetting the github token worked. I'm not quite sure how to grep for what's setting it but unsetting is good enough for now lol.

Maybe something like grep -d skip "GITHUB_TOKEN" ~/*.

So I just did Win and searched for environment variables and deleted it there and now it seems to have worked. Not sure how it got there in the first place but looks like it's fixed 🙂.

[williammartin]

Great, thanks for letting us know.