GitHub Actions "Resource not accessible by personal access token"
A step used a personal access token (not GITHUB_TOKEN) that lacks the scope or repository permission for the API call it made, so GitHub refuses the operation.
What this error means
An API call or action authenticated with a PAT fails with "Resource not accessible by personal access token", even though the same call works with a broader token.
RequestError [HttpError]: Resource not accessible by personal access token
status: 403Common causes
Classic PAT missing a scope
A classic PAT needs the right scope (repo, workflow, write:packages, etc.) for the call. A token without it gets a 403 on that resource.
Fine-grained token missing a permission
A fine-grained PAT grants per-permission access (contents, pull requests, actions). If the relevant permission is not set to write (or the repo is not selected), the call is denied.
How to fix it
Grant the token the needed permission
- For a classic PAT, add the scope the API call requires (e.g. repo or workflow).
- For a fine-grained PAT, enable the specific permission (e.g. Contents: Read and write) and select the target repository.
- Store the updated token as a secret and reference it in the step.
Prefer GITHUB_TOKEN where it suffices
If the call is within the same repo, the built-in GITHUB_TOKEN with the right permissions: block is simpler and safer than a PAT.
permissions:
contents: write
# steps then use ${{ secrets.GITHUB_TOKEN }}How to prevent it
- Scope PATs to exactly the permissions the workflow needs.
- Prefer the built-in GITHUB_TOKEN for same-repo operations.
- Document which permission each tokenized step requires.