GitHub API field note
GitHub REST API 401 Bad credentials: token and header checks
Debug GitHub REST API Bad credentials responses involving expired tokens, malformed Authorization headers, fine-grained access, and SSO authorization.
A GitHub 401 Bad credentials response points first to the token itself or how it was sent. Confirm that the value is not a revoked placeholder, the header uses Bearer or token as documented, and the request targets api.github.com or the intended Enterprise host.
Treat the complete response as an evidence record: status, headers, provider code, request identifier, method, and raw body. The sequence below separates what the response proves from the checks still needed before a safe retry or code change.
Diagnostic procedure
Work from evidence to recovery.
- 01
Inspect the final header safely
Log only the scheme and a fingerprint or last four characters—never the full token.
- 02
Check token state
Confirm expiry, revocation, resource owner, repository selection, organization SSO, and required permissions.
- 03
Separate 401 from 403
A recognized token with insufficient access may lead to 403 or a deliberately obscured 404; do not rotate credentials without reading the response.
Authorization: Bearer ${GITHUB_TOKEN}Resolve token → verify host and expiry → inspect fine-grained resource access
Evidence
HTTP 429: A rate, quota, concurrency, or resource lock limit blocked the request.
Retry-After is present; it should take precedence over a guessed delay.
The reported request window has no remaining capacity.
Next checks
01Parse Retry-After as either delta-seconds or an HTTP date before scheduling the next attempt.
No account · no upload · no endpoint calledOpen the full incident decoder and operating notes →
FAQ
Before you ship
Does APITC send this evidence to an API?
No. The matching and calculations in the linked workbench run in the active browser tab.
Should every GitHub authentication response be retried?
No. Retry behavior depends on the method, idempotency protection, provider instructions, and whether the failure is temporary.
Protocol behavior checked against the GitHub REST API troubleshooting. Recheck your pinned provider/API version before production deployment.