GITHUB_TOKEN "Resource not accessible by integration" 403 in CI

By Daniel Zoghalchali·Latchkey

The GitHub API returned 403 "Resource not accessible by integration" because GITHUB_TOKEN does not have the permission the call needs. The token is valid but its scope for that resource (issues, pull-requests, contents) is read or none.

What this error means

A step that comments on a PR, creates an issue, or updates a label fails with "RequestError [HttpError]: Resource not accessible by integration" and status 403.

HttpError: Resource not accessible by integration
    at ...
status: 403

Common causes

GITHUB_TOKEN lacks write on that resource

The default or declared permissions do not grant write for the API area the step touches, so the write is rejected with 403.

A restricted default token permission

When the repo/org default is read-only and the job adds no grant, every write call returns this 403.

How to fix it

Grant the specific write scope

1. Identify the resource the call writes (issues, pull-requests, contents).
2. Add the matching write scope to the job's permissions block.
3. Re-run so the API accepts the call.

permissions:
  pull-requests: write
  issues: write
  contents: read

Confirm it is not a fork PR with a read token

For pull_request from a fork, GITHUB_TOKEN is read-only by design; use pull_request_target carefully or a separate trusted job.

How to prevent it

• Declare the minimal write scopes each job needs.
• Map the 403 to the exact API area and grant only that.
• Expect a read-only token on fork pull_request events.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions