Jenkins 2.580.1 · REST API and CLI · Checked October 28, 2026

Jenkins: "401 Unauthorized" and "Invalid password/token for user"

Your user ID and API token reached Jenkins, and Jenkins did not accept them as a pair. Either the name is not your Jenkins user ID, or the token is not one of that user's tokens. Nothing about permissions is involved yet: that comes after Jenkins knows who you are.

What Jenkins answered

A Jenkins 2.580.1 on our machine, set to require a login, on October 28, 2026. The REST API with a real user ID and a wrong token:

curl -i -u 'tester:11abcdef0123456789abcdef0123456789' 'https://jenkins.example.com/api/json'

HTTP 401 Unauthorized
WWW-Authenticate: Basic realm="Jenkins", charset="UTF-8"

The body is Jetty's error page, "HTTP ERROR 401 Unauthorized", with MESSAGE: Unauthorized. The answer was the same for a user ID that does not exist, for an email address in place of the user ID, and for a POST that starts a build.

Jenkins' own message for this case is Invalid password/token for user: <the user ID it received> (BasicHeaderProcessor in Jenkins' source). Whether you see it depends on the version and the client: Jenkins 2.580.1 sent only "Unauthorized".

The Jenkins CLI with the same wrong token, by WebSocket (its default) and with -http:

java -jar jenkins-cli.jar -s https://jenkins.example.com/ -auth tester:<wrong token> who-am-i

io.jenkins.cli.shaded.jakarta.websocket.DeploymentException: Handshake error.
Caused by: java.lang.NullPointerException: Cannot invoke "...UpgradeRequest.getRequestURI()" because "upgradeRequest" is null

java -jar jenkins-cli.jar -s https://jenkins.example.com/ -http -auth tester:<wrong token> who-am-i

java.io.IOException: Server returned HTTP response code: 401 for URL: https://jenkins.example.com/cli?remoting=false

So a CLI "Handshake error." can be nothing more than a wrong token: run the same command with -http to see the 401.

Why Jenkins did not accept the pair

The name is not your user ID. Jenkins wants the user ID, not your full name or email address. It is the last part of your user page's address (/user/<id>/), and with LDAP, Active Directory or single sign-on it is the ID that the security realm gives Jenkins, which can differ from what you type on the login page.
The token is not one of that user's tokens. An API token belongs to one user on one Jenkins: one that was revoked, one made by a colleague, or one made on another Jenkins (a test server, say) gets 401. So does a token cut short when copied. Jenkins shows a new token once; if you no longer have it, make a new one.
No 401, but 403 and "anonymous"? Then the user ID and token never reached Jenkins: "anonymous is missing the Overall/Read permission". An Authorization: Bearer header with an API token is one way to get there: Jenkins 2.580.1 answered it 403, as anonymous.

Checking the pair with one request

curl -i -u 'your-user-id:your-api-token' 'https://jenkins.example.com/whoAmI/api/json'

200 with your user ID as "name": the pair works, and the problem is elsewhere. 401: Jenkins rejected the pair. Without -u, the same address answered 200 with "name":"anonymous", so it also tells you whether the credentials arrived at all.

To make a new token: your user page (your name at the top right), Security, API Token, Add new Token.

Jenkins builds in IntelliJ IDEA and other JetBrains IDEs

Pipeline Inbox for Jenkins, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, keeps a user ID and an API token for each Jenkins server in Settings | Tools | Pipeline Inbox for Jenkins, drops spaces before and after both, and sends them with every request. When Jenkins answers 401 it says "<server> rejected the user name or API token: check both in Settings | Tools | Pipeline Inbox for Jenkins (the user name is your Jenkins user ID)." The build list, Pipeline stages, failed tests and console logs are free; build with parameters, rebuild, stop and input steps are Pro (US$1.50 a month, with a 30-day trial).

Jenkins® is a registered trademark of LF Charities Inc.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with or endorsed by the Jenkins project or JetBrains.

More: "anonymous is missing the Overall/Read permission" · Jenkins plugins for IntelliJ IDEA compared · 日本語