GitHub · personal access tokens · Checked October 24, 2026

GitHub: 401 "Bad credentials"

The GitHub API does not accept the token at all. It has expired or been revoked, or it was never a token for this GitHub. From GitHub's Token expiration and revocation: an expired or revoked token can no longer be used, and it cannot be restored; you need a new token. Unlike a 403 ("Resource not accessible by personal access token"), changing the token's permissions will not fix this.

The whole answer

A real one (from a public report):

HTTP 401

{"message": "Bad credentials",
 "documentation_url": "https://docs.github.com/rest",
 "status": "401"}

GitHub does not fall back to reading anonymously. In that report the calls read public repositories, which work without any token, and failed the same way. To check the token alone:

curl -i -H "Authorization: Bearer your-token" https://api.github.com/user

A token that GitHub accepts answers 200 with your account. For GitHub Enterprise Server, call your server's API address instead of api.github.com.

Why a token stops working

From GitHub's Token expiration and revocation:

Expiration date: when a personal access token reaches its expiration date, it is revoked automatically.
A year without use: GitHub automatically revokes a personal access token or an OAuth token that has not been used in one year.
Pushed to a public repository or gist: a valid token that is pushed to a public repository or a public gist is revoked automatically.
Deleted: you, or for managed accounts an enterprise owner, deleted it. Enterprise owners can also revoke a token's single sign-on authorization; that gives "Resource protected by organization SAML enforcement" instead.

The same page notes that an expired or revoked token may leave an oauth_authorization.destroy action in your security log, which tells you when.

Two more causes are on your side: the token was mistyped or cut short when pasted, or it was made on another GitHub. A github.com token means nothing to a GitHub Enterprise Server, and the other way round.

Create a new token

Your profile picture, Settings, Developer settings, Personal access tokens, Fine-grained tokens, Generate new token.
The same resource owner, repositories and permissions as the old one, and an expiration. A link can open the form filled in, for example https://github.com/settings/personal-access-tokens/new?name=IDE&expires_in=90&pull_requests=write&contents=write&statuses=read. From GitHub's pre-filling a token: expires_in is 1 to 366 days or none, and without it the token expires in 30 days, or sooner if the organization has a token lifetime policy.
Generate token, copy it, and if the organization requires approval, wait for it.
Put it everywhere the old one was.

In IntelliJ IDEA: "Incorrect credentials." and "User authorization failed"

The GitHub support built into IntelliJ IDEA checks a token by reading the account with it: GET /user, the same call as the curl above. A 401, and also a 402 or a 403 that is not about the rate limit, counts as a failed login. In the source (checked October 30, 2026; IntelliJ IDEA: GHTokenCredentialsUi.kt, GithubApiRequestExecutor.kt, GHSecurityUtil.kt, GHSelectorErrorStatusPresenter.kt, GHAPIExceptionUtil.kt, GHAccountsUtil.kt):

When you log in with a token: "Incorrect credentials." and, on the next line, "Request response: Bad credentials.", the second part being GitHub's own message. It does not say which of the causes above it is.
The token field says "The following scopes must be granted to the access token:" with repo, gist, read:org, workflow, read:user and user:email. Its Generate… button opens settings/tokens/new on the same server with these scopes and the description "IntelliJ IDEA GitHub integration plugin" (with your IDE's name) filled in: the form for a personal access token (classic), the kind with scopes, not the fine-grained token of the steps above.
In the Pull Requests tool window, when GitHub refuses the saved token as the window connects to a repository: "Could not connect to repository … with account …" and "User authorization failed", without GitHub's message, and Log in again….
Logging in again keeps the account's server. For github.com it first asks "Log in to GitHub to continue", with Log In via GitHub… or Use Token…; for GitHub Enterprise it opens the token login straight away.

GitHub pull requests in IntelliJ IDEA

Pull Request Inbox for GitHub, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, keeps one token for github.com and one for your GitHub Enterprise, each in the IDE's password safe and sent only to its own host. When GitHub answers 401, the plugin says that the token expired, was revoked or is from another host, shows GitHub's message, and offers to open its settings, which link to GitHub's new-token page. The review inbox, diffs and conversations are free; approving, commenting and merging are Pro (US$1.50 a month, with a 30-day trial).

GitHub is a trademark of GitHub, Inc.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with or endorsed by GitHub, Inc. or JetBrains.