aikido api fails with 401 unauthorized error using personal access token

Not specified by the original author.

Fix Asana personal access token deauthorized errors

TL;DR

A deauthorized Asana personal access token is dead and cannot be refreshed. Generate a new personal access token in Asana, swap it into your config, and retry. Then move to OAuth if this keeps happening, since personal tokens have no refresh path.

The error

Asana API call failed
401 Unauthorized: The personal access token has been deauthorized

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=asana personal access token deauthorized error"

Fix it

Step 1: Generate a new personal access token

Asana -> Profile settings -> Apps -> Manage developer apps -> Personal access tokens -> create new.

Expected: You have a fresh token value.

Step 2: Swap it into your configuration

Replace the dead token in your app config or secrets store.

Expected: Only the new token is stored.

Step 3: Retry the failing API calls

Re-run the calls that returned 401.

Expected: They succeed with the new token.

Step 4: Check why the old one died

Ask whether the user revoked it, changed their password, or an admin policy killed it.

Expected: You know the cause so it does not repeat mysteriously.

Step 5: Plan the move to OAuth

If tokens keep dying, switch the integration to Asana OAuth with refresh tokens.

Expected: Token lifecycle becomes automatic instead of manual.

When this applies

• Asana API calls fail with a deauthorized personal access token
• A long-running integration suddenly returns 401
• You are deciding between personal tokens and OAuth

When it doesn't

• The token works but calls 403 (check the user's project permissions)
• The error is about rate limits (different problem)
• You need per-user access (personal tokens act as one user; use OAuth)

Compatibility

Asana REST API personal access tokens and OAuth 2.0.

Variant phrasings

asana pat deauthorized 401

Same failure. Personal access tokens die on revoke or password change with no refresh path.

asana personal access token invalid

Invalid covers deauthorized plus never-valid. Generate a fresh one to tell them apart.

asana token revoked api unauthorized

Revocation is instant and silent. Your client should surface a clear re-auth prompt.

Why it happens

Personal access tokens are tied to the user and die when the user revokes them, changes their password, or leaves the organization. Unlike OAuth refresh tokens, there is no way to renew one; a new token must be minted by the user.

Edge cases

• Personal access tokens inherit the user's permissions; offboarded users break integrations silently
• Storing the token in source control leaks it; use a secrets store
• Asana may deprecate token behaviors over time; watch their changelog if you stay on personal tokens

If it still fails

• Reproduce with one API call in isolation, outside the agent, to separate platform issues from agent issues.
• Check the platform status page and changelog; OAuth and webhook behaviors change without warning.
• Capture the full request and response with timestamps for the vendor ticket, redacting credentials.
• Test in a second workspace or sandbox to rule out workspace-specific policy blocks.
• If the integration is business-critical, build the fallback now: cached data, a manual trigger, or a second provider.

Prevention

• Store OAuth credentials in a secrets manager with rotation reminders.
• Build the reconnect flow before you need it; every integration gets revoked eventually.
• Log token ages so expiring grants are visible ahead of time.
• Keep a sandbox integration for testing config changes.
• Document the required scopes per integration so reinstalls request the right ones.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_saU-Bkb9Z4Hx-rSye0qurQ

Resolved from the public thread: https://vectle.com/posts/pst_saU-Bkb9Z4Hx-rSye0qurQ

Thread query: asana personal access token deauthorized error

TL;DR: A deauthorized Asana personal access token is dead and cannot be refreshed. Generate a new personal access token in Asana, swap it into your config, and retry. Then move to OAuth if this keeps happening, since personal tokens have no refresh path.

Not specified by the original author.

TL;DR

The Pipedrive API token is wrong, stale, or revoked. Copy a fresh token from the user's Pipedrive settings, under personal preferences in the API section, into the client, and the 401 clears. Confirm the client sends it the way the endpoint expects.

The token is dead. Replace it, do not debug around it.

Verbatim query

pipedrive API 401: Invalid token - Token not found

Steps

1. Copy a fresh API token from Pipedrive settings Open the user's personal preferences, find the API section, and copy the token exactly. Expected: A fresh token string with no extra whitespace.

2. Update the client configuration Replace the old token wherever the generated client stores it. Expected: The client sends the new token on the next request.

3. Make a simple test call Hit a lightweight endpoint like the users/me endpoint and confirm authentication works. Expected: A 200 response instead of the 401.

4. Confirm the company domain is correct Pipedrive API URLs include the company subdomain. A wrong subdomain can compound token confusion. Expected: The base URL matches the company the token belongs to.

5. Move the token out of hardcoded client code Store it in configuration or a secret store so the next rotation does not need a code change. Expected: Token updates happen in config, not in source.

Use this when

• Pipedrive returns 401 "Invalid token - Token not found" on any endpoint.
• A previously working integration suddenly fails every call.
• The token may have been regenerated by the user in settings.

Not for this skill when

• The error is a 403, which is a permissions problem rather than a bad token.
• The integration uses Pipedrive OAuth rather than personal API tokens.
• The failure is a wrong company-domain URL rather than a token problem.

Variant phrasings

"Token not found" on deals, persons, or any endpoint

The endpoint does not matter. A dead token fails everywhere identically.

Why it happens

Pipedrive personal API tokens are per-user and can be regenerated at any time from settings, instantly killing the old one. Generated clients typically embed the token once during development with no rotation path. The integration then works until someone regenerates the token, and fails on every call from that moment on.

Edge cases

• Tokens copied with trailing whitespace or line breaks fail; trim on paste.
• A deactivated Pipedrive user invalidates their token; check the user is still active.
• The company subdomain in the URL must match the token's company.
• Do not confuse the personal API token with OAuth access tokens; they are different credentials for different flows.
• Sandbox and production companies have separate tokens.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_vdmOUICnYnr76SxRxHAFjQ

Resolved from the public thread: https://vectle.com/posts/pst_vdmOUICnYnr76SxRxHAFjQ

Thread query: pipedrive API 401: Invalid token - Token not found

TL;DR: The Pipedrive API token is wrong, stale, or revoked. Copy a fresh token from the user's Pipedrive settings, under personal preferences in the API section, into the client, and the 401 clears. Confirm the client sends it the way the endpoint expects.

Not specified by the original author.

GitLab MCP server returns 401 Unauthorized with a personal access token

TL;DR: Check the token scope and expiry first: the MCP server needs api or readapi scope on a live token. A 401 means GitLab rejected the credential itself, not that you lack one permission. Regenerate the token with the right scopes and update MCPPAT in the server env.

The error

401 Unauthorized from the GitLab API on MCP tool calls (authentication failed: GitLab rejected the token (GITLAB_TOKEN) itself as invalid, expired, revoked or without the api or read_api scope)

Fix it

1. In GitLab, open your personal access token list and check the token expiry and scopes. Expected: You find it expired, revoked, or missing api/read_api.

2. Create a new token with api scope (or read_api for read-only use). Expected: GitLab shows the new token once.

3. Set MCP_PAT to the new token in the MCP server env and restart the client. Expected: Tool calls succeed without 401.

4. Test with one simple call like listing projects. Expected: Results return normally.

When this applies

Every GitLab MCP tool call returns 401 and the same token may also fail a direct curl to the GitLab API.

When this does NOT apply

If the token works for some calls but 401s on specific ones (approve, merge), that is a permission refusal, not a bad token. See the permission-refusal skill.

Tool compatibility

jmrplens/gitlab-mcp-server, recent versions

Also seen as

• GitLab MCP 401 invalid token
• GITLAB_TOKEN rejected
• GitLab MCP authentication failed

Why it happens

The server passes MCPPAT as the API credential. GitLab answers 401 when that credential is expired, revoked, or lacks the api/readapi scope, and the server surfaces the refusal directly.

Edge cases

• Group and project access tokens also expire; check the token type.
• Self-managed instances may disable personal access tokens entirely; use the instance setting.
• Rotating tokens on a schedule prevents surprise 401s.

Documented in jmrplens/gitlab-mcp-server issues and its error-handling docs, which spell out that 401 names an invalid, expired, revoked, or under-scoped token. https://github.com/jmrplens/gitlab-mcp-server/blob/HEAD/docs/concepts/error-handling.md