Tokens API (and maybe others) requires auth even when I am authorized (auth seems to not be working) #12048

New Issue

GiteaMirror · 2025-11-02T09:56:08-06:00

GiteaMirror commented

2025-11-02 09:56:08 -06:00

Originally created by @MohammedNoureldin on GitHub (Nov 20, 2023).

Description

I am trying to delete one of the access tokens using the following command:

curl -X 'DELETE' \
  'https://gitea.DOMAIN/api/v1/users/administrator/tokens/temp_token' \
  -H 'accept: application/json' \
  -H 'Authorization: token 2xx30c012368eaea80d532ab558a1b6cb452f3c5'

But I always get "auth required" as response even that I am authorized:
Body:

{
  "message": "auth required",
  "url": "https://gitea.orchestration.lixron.com/api/swagger"
}

Header:

 cache-control: max-age=0,private,must-revalidate,no-transform 
 content-length: 87 
 content-type: application/json;charset=utf-8 
 date: Mon,20 Nov 2023 01:27:27 GMT 
 strict-transport-security: max-age=15724800; includeSubDomains 
 x-content-type-options: nosniff 
 x-frame-options: SAMEORIGIN

I also tried quickly list the tokens and create a token instead of deletion, the issue seems to occur there also.

I also tried to pass the token as query parameter to authenticate, but it did not change. The issue is still there.

The were able to create a repository using the same token, so the issue should not be located in the token itself, IMHO.

What is wrong here?

Gitea Version

1.20

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

Kubernetes pod

Database

None

Originally created by @MohammedNoureldin on GitHub (Nov 20, 2023). ### Description I am trying to delete one of the access tokens using the following command: ``` curl -X 'DELETE' \ 'https://gitea.DOMAIN/api/v1/users/administrator/tokens/temp_token' \ -H 'accept: application/json' \ -H 'Authorization: token 2xx30c012368eaea80d532ab558a1b6cb452f3c5' ``` But I always get **"auth required"** as response even that I am authorized: Body: ``` { "message": "auth required", "url": "https://gitea.orchestration.lixron.com/api/swagger" } ``` Header: ``` cache-control: max-age=0,private,must-revalidate,no-transform content-length: 87 content-type: application/json;charset=utf-8 date: Mon,20 Nov 2023 01:27:27 GMT strict-transport-security: max-age=15724800; includeSubDomains x-content-type-options: nosniff x-frame-options: SAMEORIGIN ``` I also tried quickly list the tokens and create a token instead of deletion, the issue seems to occur there also. I also tried to pass the token as query parameter to authenticate, but it did not change. The issue is still there. The were able to create a repository using the same token, so the issue should not be located in the token itself, IMHO. What is wrong here? ### Gitea Version 1.20 ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? Kubernetes pod ### Database None

GiteaMirror added the topic/api type/bug labels 2025-11-02 09:56:08 -06:00

GiteaMirror commented

2025-11-02 09:56:09 -06:00

@MohammedNoureldin commented on GitHub (Nov 20, 2023):

This seems to be related? https://github.com/go-gitea/gitea/issues/21186

So is it by design not possible to create or delete tokens when I am authenticated using a token?

If this is the case, can I somehow delete a token using the command line? I am creating my token like this:

gitea admin user generate-access-token

But can I delete it also using CLI?

Using basic auth seems to be working in this case, but I want to be able to delete the access token without passing my username and password. Just like I was able to generate the token. Is is somehow possible?

@MohammedNoureldin commented on GitHub (Nov 20, 2023): This seems to be related? https://github.com/go-gitea/gitea/issues/21186 So is it by design not possible to create or delete tokens when I am authenticated using a token? If this is the case, can I somehow delete a token using the command line? I am creating my token like this: gitea admin user generate-access-token But can I delete it also using CLI? Using basic auth seems to be working in this case, but I want to be able to delete the access token without passing my username and password. Just like I was able to generate the token. Is is somehow possible?

GiteaMirror commented

2025-11-02 09:56:09 -06:00

@Aeyk commented on GitHub (Jun 19, 2024):

#25511

Token endpoints don't work with header tokens.

https://docs.gitea.com/development/api-usage#generating-and-listing-api-tokens

Note that /users/:name/tokens is a special endpoint and requires you to authenticate using BasicAuth and a password, as follows

@Aeyk commented on GitHub (Jun 19, 2024): #25511 Token endpoints don't work with header tokens. https://docs.gitea.com/development/api-usage#generating-and-listing-api-tokens >Note that /users/:name/tokens is a special endpoint and requires you to authenticate using BasicAuth and a password, as follows

GiteaMirror commented

2025-11-02 09:56:09 -06:00

@junedgit commented on GitHub (Sep 20, 2025):

@MohammedNoureldin hi, did you found fix this issue?

@junedgit commented on GitHub (Sep 20, 2025): @MohammedNoureldin hi, did you found fix this issue?

GiteaMirror commented

2025-11-02 09:56:10 -06:00

@MohammedNoureldin commented on GitHub (Sep 20, 2025):

Probably there will be no solution, as this seems to be in the design.

@MohammedNoureldin commented on GitHub (Sep 20, 2025): Probably there will be no solution, as this seems to be in the design.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#12048