GitHub · fine-grained personal access tokens · Checked October 24, 2026

GitHub: "Resource not accessible by personal access token"

GitHub's own explanation: the token has insufficient permissions. A fine-grained personal access token was created without a permission this call needs, or in a way that does not reach this repository. GitHub refuses with HTTP 403, and its REST answers carry a header that names the permissions the call accepts. Give the token those permissions, then try again.

The whole answer

A real one, for posting a pull request review with a token that could read (from a public report); the body has this shape (another report):

HTTP 403
x-accepted-github-permissions: pull_requests=write

{"message": "Resource not accessible by personal access token",
 "documentation_url": "https://docs.github.com/rest/...",
 "status": "403"}

From GitHub's Troubleshooting the REST API: X-Accepted-GitHub-Permissions is a comma-separated list of the permissions the endpoint requires; when there is a choice, the sets are separated by a semicolon. pull_requests=write,contents=read means both; contents=write; contents=write,workflows=write (from a public report) means either set. Many tools show only the message. To see the header, call the address that failed with curl:

curl -i -H "Authorization: Bearer your-token" "https://api.github.com/the/address/that/failed"

GitHub gives the same explanation for "Resource not accessible by integration".

Permissions that pull request tools need

From GitHub's permissions required for fine-grained personal access tokens (repository permissions):

Pull requests: read to list and read pull requests; write to review (approve or request changes), comment on lines, create a pull request and update its branch.
Contents: write to merge. The merge endpoint (PUT /repos/{owner}/{repo}/pulls/{pull_number}/merge) is listed under Contents, not Pull requests, so a token with Pull requests write can approve but not merge.
Issues or Pull requests: write to post in a pull request's conversation (POST /repos/{owner}/{repo}/issues/{issue_number}/comments accepts either).
Commit statuses: read, for the statuses that CI services set on the commits.
Actions: read, for the workflow runs of GitHub Actions (GET /repos/{owner}/{repo}/actions/runs). The list has no permission for check runs.

When the permissions look right

Then check what the token can reach. From GitHub's Managing your personal access tokens:

Resource owner: the token can only access resources owned by the owner chosen when it was made. A token made for your account does not reach an organization's private repositories, and cannot change its public ones.
Repository access: with Only select repositories, the token reaches only those. Every token can read all public repositories, so it can read a public repository outside its selection, but not change it.
Someone else's public repository: only a classic token has write access to public repositories that are not owned by you or by an organization you are a member of.
Outside collaborators can only use a classic token for the organization repositories they collaborate on.
Pending approval: if the organization requires approval for fine-grained tokens, the token stays pending until an organization administrator reviews it, and until then reads only public resources.
Blocked: an organization that blocks fine-grained tokens does not appear as a resource owner. A classic token with the repo scope is the remaining choice there, if the organization allows it: an organization can refuse classic tokens too, with a 403.

A private repository the token cannot reach answers 404 Not Found instead: GitHub does not confirm that private repositories exist (404 Not Found for an existing resource).

If the message is "Resource protected by organization SAML enforcement" instead, the organization uses single sign-on and the token needs authorizing for it: see authorize the token for single sign-on. If GitHub answers 401 "Bad credentials", the token itself is no longer accepted: see why GitHub stopped accepting it.

Create a token with the permissions

Your profile picture, Settings, Developer settings, Personal access tokens, Fine-grained tokens, Generate new token.
A name and an expiration, the Resource owner that owns the repository, Repository access that includes it, and under Permissions every permission from the header. GitHub can open the form with them filled in, for example https://github.com/settings/personal-access-tokens/new?name=IDE&pull_requests=write&contents=write&statuses=read (pre-filling a token).
Generate token, copy it, and if the organization requires approval, wait for it.
Put the new token where the old one was, and delete the old one on the same page.

In IntelliJ IDEA: "User authorization failed"

How the GitHub support built into IntelliJ IDEA takes this refusal, in its source (checked October 30, 2026; IntelliJ IDEA: GithubApiRequestExecutor.kt, GithubApiRequest.kt, GHAPIExceptionUtil.kt, GHSelectorErrorStatusPresenter.kt):

A REST 403 whose message does not say "API rate limit exceeded" is taken as a refused login, this one included. When the Pull Requests tool window connects, it reads "Could not connect to repository … with account …" and "User authorization failed", with Log in again…; GitHub's message is not shown. The request code does not read X-Accepted-GitHub-Permissions either; the curl above shows both. Logging in again does not change what the token may do: it needs the permissions.
GraphQL answers that carry errors instead of the data asked for: an error of the type INSUFFICIENT_SCOPES is also taken as a refused login, and any other error is shown with GitHub's message.
When GitHub's message begins with "Could not resolve to a Repository", IntelliJ IDEA adds "Repository not found or access denied. This is likely due to OAuth App access restrictions within your organization." and a link to a JetBrains support article. The note speaks only of an organization's OAuth app access restrictions; if you logged in with a token, its resource owner and repository access above are worth checking too.

GitHub pull requests in IntelliJ IDEA

Pull Request Inbox for GitHub, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, reads with a fine-grained token's Pull requests, Contents and Commit statuses read (and GitHub Actions runs with Actions read), and approves, comments and merges with Pull requests and Contents write (or a classic token with repo). When GitHub answers with this message, the plugin shows it, says which permissions the token needs, and offers to open its settings, which link to GitHub's new-token page. The review inbox, diffs and conversations are free; approving, commenting and merging are Pro (US$1.50 a month, with a 30-day trial).

GitHub is a trademark of GitHub, Inc.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with or endorsed by GitHub, Inc. or JetBrains.