PAT not working

[gc-robotics]

Why are you starting this discussion?

Question

What GitHub Actions topic or product is this about?

General

Discussion Details

Hi! Currently facing some authentication issues, for which I am seeking your expert guidance.

I have two GH repos, repo_1 and repo_2.
repo_1 defines a workflow that should invoke a secondary workflow in repo_2.

I have created a PAT for private repos and - just for testing - I assigned all possible permissions. (repo, workflow, actions, etc.)

If I try to invoke the /users endpoint with this token, it works fine.

If I try to invoke another workflow in another repo of mine, I receive 403.

The PAT is associated to my user. My user has writing access.
The PAT is for all private repo, It allows all possible actions/permissions.

Any idea why I am still getting a 403 pls? any help would be greatly appreciated.

Thank you.

[Uwami-Mgxekwa]

You’re hitting 403 because the workflow in repo_2 must explicitly allow external triggering and your PAT must be used correctly.

If you want it to match the original exactly, here’s the plain version:

Fix steps:

1. In repo_2 workflow, add:
   on:
   workflow_dispatch:

2. Ensure your PAT has repo + workflow scopes.

3. Store the PAT as a secret in repo_1 (e.g., REPO2_TOKEN).

4. From repo_1 workflow, call the API:

   • name: Trigger repo_2 workflow
     run: |
     curl -X POST
     -H "Authorization: token ${{ secrets.REPO2_TOKEN }}"
     -H "Accept: application/vnd.github+json"
     https://api.github.com/repos/<repo_2>/actions/workflows/<workflow_file.yml>/dispatches
     -d '{"ref":"main"}'

5. Confirm the PAT owner has write access to repo_2.

That should clear the 403.

[gc-robotics]

I have just tried to use curl instead of gh workflows run. I still get the same error:

{ "message": "Resource not accessible by personal access token", "documentation_url": "https://docs.github.com/rest/actions/workflows#create-a-workflow-dispatch-event", "status": "403" }

[gc-robotics]

thanks for the answer.

Let's check together pls.

workflow_disptach present on repo2:

on:
push:
branches:

main
pull_request:
branches:
main
workflow_dispatch:
workflow_call:

permissions on PAT:

Read access to Dependabot alerts, actions, actions variables, administration, artifact metadata, attestations api, code, codespaces, codespaces lifecycle admin, codespaces metadata, commit statuses, custom properties for repositories, dependabot secrets, deployments, discussions, environments, issues, merge queues, metadata, pages, pull requests, repository advisories, repository hooks, secret scanning alert dismissal requests, secret scanning alerts, secret scanning push protection bypass requests, secrets, and security events Read and Write access to codespaces secrets and workflows

stored in repo1 as AUTOMATION_TOKEN. referenced with secrets.AUTOMATION_TOKEN.

steps: - name: Show token run: | curl -L \ -H "Authorization: Bearer ${{ secrets.AUTOMATION_TOKEN }}" \ -H "Accept: application/vnd.github.v3+json" \ https://api.github.com/user
this works.

I trigger repo2 from repo1, slightly differently from your version:
- name: Trigger 2 env: GH_TOKEN: ${{ secrets.AUTOMATION_TOKEN }} run: | gh workflow run "provision" \ --repo my_org/repo2 \ --ref main
I created the PAT with my user (Owner) for all private repos; I imagine it has writing access on repo2? is there a way to confirm it?
As you can see, it seems to me everything is in order, but I still get that 403.

Please, let me know if I am doing anything wrong. thanks.

[gc-robotics]

I regenerated the token and it worked with this set of permissions:

Read access to metadata
Read and Write access to actions, administration, code, and workflows