fossa analyze "401 Unauthorized" invalid API key in CI

By Daniel Zoghalchali·Latchkey

fossa analyze tried to upload results to the FOSSA API and got 401 Unauthorized because FOSSA_API_KEY was not set, was empty, or the CI job could not read the secret.

What this error means

The CLI stops during upload with a 401 / "invalid API key" style error. It usually happens on forked-PR builds or when the secret name in the workflow does not match the stored secret.

[ERROR] Error: 401 Unauthorized
  Failed to upload analysis to the FOSSA API.
  Ensure FOSSA_API_KEY is set to a valid API key.

Common causes

The secret is not injected into the job

Secrets are not passed to workflows triggered by pull requests from forks, so FOSSA_API_KEY is empty and the API rejects the call.

The key is wrong or revoked

A rotated or mistyped key, or a push key used where a full-access key is needed, returns 401 from the FOSSA API.

How to fix it

Wire the API key into the environment

1. Store the key as a repository or organization secret named FOSSA_API_KEY.
2. Expose it to the step via env so the CLI can read it.
3. For fork PRs, run FOSSA on pull_request_target or on push to trusted branches only.

- name: FOSSA analyze
  env:
    FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
  run: fossa analyze

Verify the key value

Confirm the stored secret matches a current, valid FOSSA API key and has not been rotated out from under the pipeline.

# quick local check with the same key CI uses
FOSSA_API_KEY=xxxx fossa analyze --output

How to prevent it

• Keep the secret name identical in the workflow and in repo settings.
• Rotate keys through the secret store so CI updates automatically.
• Skip FOSSA on untrusted fork PRs where secrets are unavailable.

Frequently asked questions

Related guides

References

• GitHub Actions documentation