pscale "not authenticated" (PLANETSCALE_SERVICE_TOKEN) in CI

By Kaveh Alemi·Latchkey

pscale defaults to a browser OAuth login that CI cannot complete. For automation it authenticates with a service token: an id and a secret, plus the org name. Missing any of the three makes it report that you are not authenticated.

What this error means

A pscale command fails with "not authenticated" or "Error: no access token" in the workflow, even though the same command works after pscale auth login locally.

Error: not authenticated. Please run `pscale auth login` or set a service token
with --service-token and --service-token-id.

Common causes

No service token in CI

The CLI cannot run the interactive login in a headless job and no PLANETSCALE_SERVICE_TOKEN was provided, so it has no credentials.

Token id, secret, or org is missing

Service-token auth needs the token id, the token secret, and the organization. Omitting any one causes the CLI to reject the request.

How to fix it

Pass the service token and org

1. Create a service token in the PlanetScale org settings with the needed database access.
2. Store the id and secret as CI secrets.
3. Pass all three (id, token, org) to each pscale command.

pscale database list \
  --org "$PLANETSCALE_ORG" \
  --service-token-id "$PLANETSCALE_SERVICE_TOKEN_ID" \
  --service-token "$PLANETSCALE_SERVICE_TOKEN"

Set them as environment variables

pscale reads the token id, token, and org from env vars, so set them at job level to avoid repeating flags.

env:
  PLANETSCALE_SERVICE_TOKEN_ID: ${{ secrets.PLANETSCALE_SERVICE_TOKEN_ID }}
  PLANETSCALE_SERVICE_TOKEN: ${{ secrets.PLANETSCALE_SERVICE_TOKEN }}
  PLANETSCALE_ORG: my-org

How to prevent it

• Use a scoped service token for CI, never a personal browser login.
• Set token id, token secret, and org together at the job level.
• Grant the token only the databases and actions the workflow needs.

Frequently asked questions

Related guides

References

• GitHub Actions documentation