Gitea · gitea.com · Forgejo · Codeberg · Actions · API · Checked October 28, 2026

Gitea Actions API: "token is required" on a public repository

On Gitea 1.25 and later, listing the Actions runs, jobs or workflows of a repository through the API, and reading job or run logs, answers 401 with {"message":"token is required"} when the request carries no token, even for a public repository. The check sits on the routes themselves, so every Gitea server does it, not only gitea.com, and no setting turns it off. A token of any account that can read the repository is enough, with the read:repository scope. Forgejo answers the same requests without a token.

Which requests ask for a token on Gitea

Checked in 1.25.0, 1.26.0, 28.0.0 and 28.2.0, the latest release, of October 18, 2026 (routers/api/v1/api.go: the routes below carry reqToken(), which answers 401 token is required to a request that is not signed in). Under /api/v1/repos/{owner}/{repo}:

Token required: GET /actions/runs (the list of runs), GET /actions/jobs (the list of jobs), GET /actions/workflows and the routes under it, GET /actions/jobs/{job_id} and /actions/jobs/{job_id}/logs, GET /actions/runs/{run}/logs.
No token for a public repository: GET /actions/runs/{run} (one run, by its id), GET /actions/runs/{run}/jobs, GET /actions/runs/{run}/artifacts, GET /actions/artifacts and GET /actions/tasks. In 28.2 also the attempts of a run, /actions/runs/{run}/attempts/{attempt} and its /jobs.
Re-running, cancelling and starting runs ask for a token and write access on both Gitea and Forgejo.

So a script can read one run and its jobs without a token when it already knows the run id, but cannot list the runs to find it, and cannot read any log. GET /actions/tasks lists the latest tasks without a token, each with its run number and a url that ends in the run id.

What gitea.com answered

On October 28, 2026, gitea.com (version 29.0.0+dev) answered requests without a token for its public repository gitea/runner as the source says: 401 token is required for /actions/runs, /actions/jobs, /actions/workflows, a job, its log and the log of a run; 200 for /actions/tasks, one run and the jobs of that run.

The token

Make it under User Settings | Applications (/user/settings/applications, Manage Access Tokens) and pick the permissions in Select permissions (docs.gitea.com: API Usage).
Reading needs Read on repository (read:repository): the repository routes ask for the repository scope, at the read level for GET and the write level for POST, PUT, PATCH and DELETE (tokenRequiresScopes in api.go).
A token without that scope answers 403 token does not have at least one of required scope(s), required=[read:repository], ....
Send it as Authorization: token .... Gitea wants the word token before the key, as the documentation says.
The token belongs to the server it was made on: a gitea.com token does not work on your own Gitea server, nor the other way round.

Forgejo

Forgejo does not put a token check on reading: the list of runs, one run, its jobs, a job, the log of a job and the log of a run answer without a token for a public repository (routers/api/v1/api.go). On October 28, 2026, code.forgejo.org answered the list of runs, one run, its jobs, a job and the log of a run without a token. A private repository needs a token on both servers.

Forgejo and Gitea Actions in IntelliJ IDEA

Pipeline Inbox for Forgejo and Gitea, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, reads public repositories on Forgejo servers without a token. On a Gitea server without one, it says that the server shows the runs only with a token and points to Settings | Tools | Pipeline Inbox for Forgejo and Gitea, where each server keeps its own token in the IDE password safe (read:repository and read:user to read). The runs, jobs and logs are free; re-running, cancelling and starting workflows are Pro (US$1.50 a month, with a 30-day trial).

Get it on JetBrains Marketplace

Forgejo, Gitea and Codeberg are names of their respective owners; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with or endorsed by the Forgejo project, Codeberg e.V., the Gitea project or JetBrains.

More: "No matching online runner with label" · Workflow dispatch refused · Job log expired · Forgejo Actions and Gitea Actions in JetBrains IDEs · Forgejo and Gitea token scopes · 日本語