buf "buf push" 401 Unauthorized (BUF_TOKEN) in CI

By Kaveh Alemi·Latchkey

buf push publishes a module to the Buf Schema Registry, which requires authentication. A 401 means no valid token was sent: BUF_TOKEN is unset, wrong, or was never wired into buf-setup-action.

What this error means

buf push fails with "Failure: 401 Unauthorized" or "authentication required" when publishing to buf.build, while unauthenticated commands like buf lint still pass.

Failure: 401 Unauthorized: you are not authenticated. Set a token with
"buf registry login" or the BUF_TOKEN environment variable.

Common causes

BUF_TOKEN is not set in the job

buf push needs a registry token; without BUF_TOKEN in the environment (or a login), the request is anonymous and rejected with 401.

The token is not passed to buf-setup-action

buf-setup-action logs in only when given the token input; omitting it leaves buf unauthenticated for push.

How to fix it

Pass BUF_TOKEN to setup and push

1. Create a BSR token and store it as a repository secret.
2. Pass it to buf-setup-action as buf_token (it configures login).
3. Run buf push.

- uses: bufbuild/buf-setup-action@v1
  with:
    buf_token: ${{ secrets.BUF_TOKEN }}
- run: buf push

Or set BUF_TOKEN in the step env

If you invoke buf directly, export the token so buf authenticates the push.

env:
  BUF_TOKEN: ${{ secrets.BUF_TOKEN }}

How to prevent it

• Keep the BSR token in CI secrets, never in the repo.
• Pass buf_token to buf-setup-action so login is configured once.
• Grant the token least-privilege access to the target module.

Frequently asked questions

Related guides

References

• GitHub Actions documentation