My API token suddenly stopped working. Why?

Why this happens

An API token carries its owner's permissions and group scope. It can fail in a few ways. The captured pages let us name four.

• A new token replaced the old one, and because the API returns a raw secret only once, the value in your CI may be an old one.
• An admin revoked every token that user held.
• The owner lost a permission such as ci:trigger, or an admin removed the user from the workspace altogether.
• Someone changed the secret or the URL in your CI settings.

How to fix it

1. Run GET /api/auth/me against your app URL with the header Authorization: Bearer <token>. It returns the current user when the token works.
2. If it fails, open your CI settings and check CYBERLOP_URL and CYBERLOP_API_TOKEN for typos, trailing spaces or an old value.
3. Ask a workspace administrator whether the token owner still has access and the right permissions.
4. Ask the administrator to issue a fresh token in Administration → Users. Copy it at once, because Cyberlop shows it once.
5. Paste the new value into your CI secret store and rerun the job.

Still not working?

If /api/auth/me works but a scan call fails, then the token is valid and the owner is missing a permission that the call needs. Each endpoint in the API Reference lists the key it needs. A trigger call needs ci:trigger, and the result call needs scan:read.

Never paste a token into a chat or ticket. Send us the time of the failure and the HTTP status instead. Read what to do about a lost API token or how to fix an API permission error.

Related questions

• I lost my API token. Can I see it again?
• How do I revoke a user's API tokens?
• Why does my API call return a permission error?
• My CI job can't trigger a scan. What should I check?
• How do I get a personal API token?

Full tutorial

Cyberlop API tokens and permissions: how to issue and limit them

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre