Codecov "Token required" / rate-limit error in CI

By Daniel Zoghalchali·Latchkey

Codecov rejected the upload because it had no valid token: tokenless uploads from forks and some setups are not accepted, and unauthenticated requests hit a rate limit. The fix is to supply a repository upload token.

What this error means

The Codecov step fails with "Token required - not valid tokenless upload" or "Rate limit reached. Please upload with the Codecov repository upload token to resolve issue."

['error'] Token required because branch is protected, or because of rate limit:
Rate limit reached. Please upload with the Codecov repository upload token to resolve issue.

Common causes

No upload token configured

Public repositories once uploaded tokenlessly, but rate limits and protected branches now require the repository upload token to be passed to the action.

The token is not exposed to forked-PR runs

Secrets are not available to workflows triggered by forks, so a fork PR cannot read CODECOV_TOKEN unless you use the pull_request_target pattern carefully.

How to fix it

Add the repository upload token as a secret

1. Copy the upload token from the Codecov repository settings.
2. Store it as the CODECOV_TOKEN repository or organization secret.
3. Pass it to the action so uploads are authenticated and not rate-limited.

- uses: codecov/codecov-action@v5
  with:
    token: ${{ secrets.CODECOV_TOKEN }}

Handle fork PRs without leaking the token

For fork contributions, upload coverage from a separate workflow_run job on the base repo where the secret is available, rather than exposing it to fork-triggered runs.

How to prevent it

• Always configure CODECOV_TOKEN, even for public repos, to avoid rate limits.
• Store the token as a secret, never in the workflow file.
• Use a base-repo job to upload coverage for fork PRs.

Frequently asked questions

Related guides

References

• GitHub Actions documentation