Forgejo · Gitea · Codeberg · access tokens · Checked October 24, 2026

Forgejo and Gitea: 401 "token is required" and the unknown-token messages

The server answers HTTP 401 when a request carries no token it accepts. The words differ by server and version, but there are only two situations: no token arrived (token is required), or a token arrived that the server does not know (the other messages below). Neither is about permissions: a token that is valid but lacks a scope gets 403 "token does not have at least one of required scope(s)" instead.

What each server says

On October 24, 2026 we sent one request without a token and one with a made-up token to /api/v1/user on codeberg.org (Forgejo 16.0.0-dev), code.forgejo.org (Forgejo 17.0.0-dev) and gitea.com (Gitea 29.0.0-dev). The source code gives the same messages for the versions named.

No token, every version: {"message": "token is required", "url": "https://codeberg.org/api/swagger"} (Gitea's routers/api/v1/api.go, Forgejo's req_token.go).
Unknown token, Forgejo 16 and 17 (Codeberg, code.forgejo.org): a message of several lines, one for each way of signing in that the server tried, among them access token does not exist [sha: …].
Unknown token, Gitea 1.26 and later (1.26, 1.27, 28.x, gitea.com): invalid username, password or token.
Unknown token, Gitea 1.25 and earlier, and Forgejo 11: user does not exist [uid: 0, name: ]. The server found no token, so no user, and names user 0 (Gitea's services/auth/oauth2.go from v1.21.0 to v1.25.0, Forgejo's at v11.0.0; a public report). It does not mean that your account is gone.

To check a token by itself:

curl -i -H "Authorization: token your-token" "https://codeberg.org/api/v1/user"

A token the server accepts answers 200 with your account. Use your own server's address instead of codeberg.org.

"token is required"

No token reached the server. Public repositories can be read without one, but private repositories, your own pull requests and review requests, and every change need a token. If you did send one, something on the way removed it: a proxy or a server in front of Forgejo or Gitea that drops the Authorization header gives the same answer.

A token the server does not know

It was deleted on the Applications page.
It was mistyped, or cut short when pasted.
It was made on another server. A Codeberg token means nothing to your own Forgejo or Gitea server, and the other way round.

Create a new token

Your avatar, Settings, Applications (the address is /user/settings/applications on your server, for example https://codeberg.org/user/settings/applications).
Under Access tokens, Generate new token: a name, Repository and organization access, and under Select permissions the same groups as before (which ones pull request tools need).
Generate token and copy it. The server says it will not be shown again.
Put it everywhere the old one was, on the server it was made on.

Forgejo and Gitea pull requests in IntelliJ IDEA

Pull Request Inbox for Forgejo and Gitea, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, keeps one token for Codeberg and one for your own server, each in the IDE's password safe and sent only to its own server. Without a token it reads public repositories; for a private one it says that it needs an access token. When the server refuses a token with 401, the plugin says that the server rejected it (expired or deleted, or from another server), shows the server's message, and offers to open its settings, which link to your server's token page. Reading is free; approving, commenting and merging are Pro (US$1.50 a month, with a 30-day trial).

Forgejo, Gitea and Codeberg are names of their respective owners; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with or endorsed by the Forgejo project, Codeberg e.V., the Gitea project or JetBrains.