crowdin cli upload sources failed 401 unauthorized

Fix Crowdin CLI upload sources failing with 401 unauthorized

TL;DR

The 401 means your personal access credential is missing, expired, or lacks project scope, so generate a fresh one and check the config. Verify the credential works with a direct API call before blaming the CLI. Nine times out of ten the credential in crowdin.yml is stale or was pasted with a typo.

The error

401 Unauthorized: Invalid credentials
$ crowdin upload sources
ERROR: request failed with status code 401

Fix it

Step 1: Test the credential directly against the API

curl -s -o /dev/null -w "%{http_code}" -H "your auth header https://api.crowdin.com/api/v2/user

Expected: 200 means the credential is good, 401 means it is bad or expired.

Step 2: Check what the CLI config actually sends

grep -n "api_token\|project_id" crowdin.yml | head -5

Expected: The config points at the right project and references a credential.

Step 3: Generate a fresh personal access credential with project scope

node -e "console.log('in Crowdin: profile settings, API, new personal access credential, grant the project scope')"

Expected: You have a new credential value copied once.

Step 4: Store it in the environment and retry the upload

crowdin upload sources | tail -3

Expected: With CROWDINPERSONALTOKEN set in your shell to the new credential, the upload succeeds with no 401.

When to use this

• crowdin CLI commands fail with 401 unauthorized
• Uploads worked before and suddenly stopped

When NOT to use this

• The CLI fails with 404, the project id is wrong
• The CLI fails with 429, that is rate limiting

Tool and version compatibility

• Crowdin CLI v3/v4, crowdin.yml config
• Personal access credentials with project scope

Variant phrasings

401 only in CI

The CI secret holding the credential expired or was rotated. Update the secret, the local config is fine.

401 for one project but not another

The credential lacks scope on that project. Regenerate with the right project selected.

Why it happens

The CLI sends the configured credential on every request. If it expired, was revoked, never had the project scope, or was pasted wrong into crowdin.yml or the environment, the API answers 401 before looking at anything else.

Edge cases

• Credentials shown once at creation, if you lost it you must regenerate
• Organization SSO can invalidate personal credentials, check with your admin
• The CLI also reads CROWDINPROJECTID from env, a mismatch 404s instead

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_-HYheu1kKoBVcxZdacQa3A