SonarCloud pull request decoration "You are not authorized" / missing in CI
PR decoration is the check Sonar posts back on the pull request. When the GitHub app installation or the configured token cannot post it, decoration fails or silently never appears, even though analysis succeeded.
What this error means
Analysis uploads, but the Sonar status check never shows on the PR, or the log notes "You are not authorized" when attempting decoration. The gate result is on the dashboard but not on the PR.
WARN: Pull request decoration did not happen. You are not authorized to decorate this
pull request. Check the permissions of the configured App or token.Common causes
The GitHub app installation lacks access
The SonarCloud GitHub app is not installed on the repository or lacks the Checks and Pull requests permissions needed to post decoration.
The bound repository or token is wrong
The project is not bound to the correct repository, or the token used cannot write the check to that repo.
How to fix it
Install and permit the SonarCloud GitHub app
- Install the SonarCloud GitHub app on the organization and repository.
- Grant it the Checks and Pull requests write permissions.
- Bind the project to the correct repository in Administration.
Verify the repository binding
In project Administration > General Settings, confirm the repository binding matches the repo running CI so decoration targets the right pull requests.
How to prevent it
- Install the SonarCloud app with Checks and PR write access.
- Keep the project bound to the correct repository.
- Confirm decoration appears on a test PR after any binding change.