Maven deploy "401 Unauthorized" to Central in CI
The Central publishing endpoint rejected the deploy because the credentials Maven sent were missing or invalid. Maven matches the repository id in your POM to a <server> entry in settings.xml; if that entry is absent or wrong, you get 401.
What this error means
mvn deploy fails with "Failed to deploy artifacts: Could not transfer artifact ... Return code is: 401, ReasonPhrase: Unauthorized." or "status code: 401, reason phrase: Unauthorized".
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-deploy-plugin:deploy
[ERROR] Failed to deploy artifacts: Could not transfer artifact com.example:lib:jar:1.0.0
[ERROR] Return code is: 401, ReasonPhrase: Unauthorized.Common causes
No matching <server> credentials in settings.xml
The <id> of the distribution repository in the POM has no matching <server> in settings.xml, so Maven sends no (or default) credentials.
Wrong token type for the Central Portal
The Central Portal expects a generated user token (username and password), not your Sonatype account password. The wrong credential returns 401.
How to fix it
Provide a settings.xml server with the token
Add a <server> whose id matches the publishing repository id, with the portal user token injected from CI secrets.
<settings>
<servers>
<server>
<id>central</id>
<username>${env.CENTRAL_USERNAME}</username>
<password>${env.CENTRAL_PASSWORD}</password>
</server>
</servers>
</settings>Pass the token via setup-java
setup-java can write the server entry and read the credentials from env, keeping secrets out of the file.
- uses: actions/setup-java@v4
with:
distribution: temurin
java-version: 17
server-id: central
server-username: CENTRAL_USERNAME
server-password: CENTRAL_PASSWORDHow to prevent it
- Match the distributionManagement repository id to a settings.xml server id.
- Use a generated Central Portal user token, not your account password.
- Inject credentials from CI secrets, never commit them to settings.xml.