Snyk "Authentication error" (SNYK_TOKEN missing) in CI

By Kaveh Alemi·Latchkey

The Snyk CLI needs an API token to run in CI. When SNYK_TOKEN is unset, empty, or wrong, snyk container test fails with an authentication error before scanning anything. Injecting a valid token from a secret fixes it.

What this error means

Snyk exits immediately with "Authentication error" or "snyk auth ... required", not a vulnerability result. Public commands may work but authenticated tests do not.

Authentication error (SNYK-0005)

Authentication credentials not recognized, or user access is not provisioned.
Run `snyk auth` or set the SNYK_TOKEN environment variable.

Common causes

SNYK_TOKEN is not exposed to the step

The secret was never set, or not passed into the job env, so the CLI runs unauthenticated.

The token is invalid or revoked

A rotated or wrong token authenticates as no one, producing the same error as a missing one.

How to fix it

Inject SNYK_TOKEN from a secret

1. Store the Snyk API token as a repository or organization secret.
2. Expose it as SNYK_TOKEN in the job or step env.
3. Re-run so the CLI authenticates before the container test.

env:
  SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
steps:
  - run: snyk container test myimage:latest --severity-threshold=high

Rotate and update a revoked token

If the token was revoked, generate a new one in Snyk and update the secret in one place.

# verify auth locally before wiring into CI
SNYK_TOKEN=... snyk auth --check

How to prevent it

• Keep the Snyk token in CI secrets, never in the workflow file.
• Reference it as SNYK_TOKEN in env so every Snyk step sees it.
• Rotate the token on a schedule and update the secret centrally.

Frequently asked questions

Related guides

References

• GitHub Actions documentation