GitHub Actions GITHUB_TOKEN expired during a long job

By Daniel Zoghalchali·Latchkey

The automatic GITHUB_TOKEN is minted per job with a bounded lifetime. A job that runs longer than that lifetime can see API/push calls start failing with auth errors near the end.

What this error means

Early API and git operations succeed, but late in a long job calls using GITHUB_TOKEN fail with "Bad credentials" or 401, even though nothing about the token usage changed.

remote: Invalid username or password.
fatal: Authentication failed for 'https://github.com/ORG/REPO.git/'

Common causes

Job exceeds the token lifetime

The GITHUB_TOKEN issued at job start ages out before a very long job completes, so credentials captured early become invalid.

Token cached and reused after expiry

A long step captured the token value and kept using it past its validity window.

How to fix it

Shorten the job or refresh credentials

1. Split the long job so each job fits well within the token lifetime.
2. For very long-lived work, use a GitHub App installation token you can refresh.
3. Re-read GITHUB_TOKEN late rather than capturing it at the start.

Let managed runners retry late-token failures

Managed runner platforms like Latchkey auto-retry jobs that fail on transient token-expiry near the end of a long run, re-dispatching with a fresh token rather than surfacing the auth error.

How to prevent it

• Keep individual jobs comfortably shorter than the token lifetime.
• Use a refreshable App installation token for long workloads.
• Avoid caching the token value across long steps.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions