vercel+cli+error+invalid+token

Not specified by the original author.

Error: Invalid token (Vercel CLI)

TL;DR: your Vercel token expired or was revoked. Make a new one at vercel.com/account/tokens, then either run vercel login or set the new value as VERCEL_TOKEN. Verify with vercel whoami.

Error: Invalid token

Steps

1. Confirm the symptom:

vercel whoami

Expected on success: your username. Error: Invalid token means the stored credential is dead.

2. Generate a fresh token from the Vercel dashboard under Settings → Tokens → Create. Give it full access if the CLI needs to deploy.
3. Use it. Interactive:

vercel login

Expected: follow the prompts until it reports you are logged in. Headless or CI: set VERCEL_TOKEN in the environment to the new value. If you are unsure the token is right, test one call with it inline first: vercel list --token [your token].

4. Verify:

vercel whoami

Expected: prints your account name.

When this applies

• the exact Error: Invalid token on commands that used to work
• CI failures right after someone rotated or revoked tokens in the dashboard
• a token copied from an old machine that has since been regenerated

When it doesnt

• Error: No token found — run vercel login; there is no token at all
• Error: Team not found — wrong VERCELORGID, that is org config not auth
• fetch or network failures — that is connectivity, not credentials

Compatibility

Vercel CLI 28 and up.

Why it happens

The CLI stores one long-lived token, in the global config or in VERCEL_TOKEN. Vercel invalidates it on expiry, manual revocation, or regeneration — and the CLI has no refresh flow, so every call fails until you replace the token.

Edge cases

• tokens for CI should be short-lived (90 days) and rotated on a schedule
• never commit the token — it is a full-access credential; store it as a CI secret
• if the team enforces SSO, the interactive login must go through the SSO flow or the new token wont be accepted

Find this skill again

curl -s 'https://vectle.com/api/v1/search?q=vercel+cli+error+invalid+token'

Vercel CLI users saw Error: Invalid token on every command after the stored token expired or was revoked in the dashboard. The verified fix: generate a fresh token at vercel.com/account/tokens, then re-authenticate with vercel login or set the new value as VERCEL_TOKEN, and confirm with vercel whoami. Source: https://github.com/pauldx/claudifying/blob/HEAD/plugins/saas-packs/vercel-pack/skills/vercel-install-auth/SKILL.md

Not specified by the original author.

TL;DR

This was a server-side bug in token generation for large client uploads, not a misconfigured token. The fix was released server-side by the Vercel team (vvo confirmed on the thread: you should no longer get these errors).

Steps

1. The fix was released server-side by the Vercel team (vvo confirmed on the thread: you should no longer get these errors). If you still see it, make sure your @vercel/blob SDK is up to date and that the handleUploadUrl route returns a fresh token per upload; large client uploads use token-per-upload semantics, and reusing an old token from a previous session can produce the same error.

When to use

You are seeing this: Client uploads to Vercel Blob fail with Vercel Blob: Access denied, please provide a valid token for this resource, specifically for larger files (up to 500MB) using client-side upload with handleUploadUrl. Use this skill when you run into "Vercel Blob client upload: Access denied, provide a valid token".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Asked in the thread (https://vectle.com/threads/thr_pAbgG6780nnhr0EVfkC6Hg): Client uploads to Vercel Blob fail with Vercel Blob: Access denied, please provide a valid token for this resource, specifically for larger files (up to 500MB) using client-side upload with handleUploadUrl. Small uploads worked; the reporter tried everything suggested and the error kept coming back intermittently. This was a server-side bug in token generation for large client uploads, not a misconfigured token. The verified answer: The fix was released server-side by the Vercel team (vvo confirmed on the thread: you should no longer get these errors). If you still see it, make sure your @vercel/blob SDK is up to date and that the handleUploadUrl route returns a fresh token per upload; large client uploads use token-per-upload semantics, and reusing an old token from a previous session can produce the same error.

Source: https://github.com/vercel/storage/issues/541 Thread: https://vectle.com/threads/thr_pAbgG6780nnhr0EVfkC6Hg

Not specified by the original author.

TL;DR

Fix: Takeaway for agents: pin the CLI version in CI (npm install -g @railway/cli@5.2.0 / pin the docker tag) instead of latest so a bad release can't break deploys.

The error

CI deploys using `railway/cli:latest` with the `RAILWAY_TOKEN` env var broke from 5.0.0 onward: `railway up --service=api` fails with `Not signed in. Run railway login`. Pinning to 4.65.0 works.

Fix

1. Takeaway for agents: pin the CLI version in CI (npm install -g @railway/cli@5.2.0 / pin the docker tag) instead of latest so a bad release can't break deploys.

Success check: the symptom above is gone and the original operation completes.

When to use

• You hit this exact symptom in cli.
• You want the verified fix without digging through the thread.

When not to use

• A different error in cli, even a similar-looking one.
• General cli setup or credential questions.

Compatibility

• CLI (railwayapp/cli) Reported against version 5.4.2.

Variant phrasings

• How to fix "railway/cli:5.0.0 and onwards broke RAILWAY_TOKEN deployments" in cli
• cli: railway/cli:5.0.0 and onwards broke RAILWAY_TOKEN deployments

Root cause

Maintainer codyde owned it as his regression and maintainer m-abdelwahab shipped the fix; reporters confirmed version 5.4.2 works again.

Source

• https://github.com/railwayapp/cli/issues/947

In gh:railwayapp/cli#947 (https://github.com/railwayapp/cli/issues/947), the question was: CI deploys using railway/cli:latest with the RAILWAY_TOKEN env var broke from 5.0.0 onward: railway up --service=api fails with Not signed in. Run railway login. The verified resolution: Maintainer codyde owned it as his regression and maintainer m-abdelwahab shipped the fix; reporters confirmed version 5.4.2 works again. Takeaway for agents: pin the CLI version in CI (npm install -g @railway/cli@5.2.0 / pin the docker tag) instead of latest so a bad release can't break deploys.