# "401 - Bad credentials" for a deploy entry generated by \`travis setup releases\` **URL:** \ **Category:** Deployment\ **Tags:** github-releases\ **Created:** [November 25, 2019, 12:33pm UTC](https://travis-ci.community/t/401-bad-credentials-for-a-deploy-entry-generated-by-travis-setup-releases/6130 "2019-11-25T12:33:37Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![luckzhiwei](https://avatars.discourse-cdn.com/v4/letter/l/7993a0/32.png) [@luckzhiwei](https://travis-ci.community/u/luckzhiwei)\ **Post date:** [November 25, 2019, 12:33pm UTC](https://travis-ci.community/t/401-bad-credentials-for-a-deploy-entry-generated-by-travis-setup-releases/6130/1 "2019-11-25T12:33:37Z")
Hope you can help solve it When I use `travis setup releases` to generate the deploy api\_key like this ```auto deploy: provider: releases api_key: secure: aSaEvrpwgeH9AObclfv.... ``` It’s OK and deploy successfully. When I copy the secure value into Travis-CI environment variables like this: ![53](https://us1.discourse-cdn.com/flex015/uploads/travis_ci/original/2X/0/0c4dcc53d563adfa9c4e22d8460126f6a132b6e0.png) and use the api\_key like this: ```auto deploy: provider: releases api_key: secure: $TOKEN file: "./GCanvas/core/test/linux/build/result.txt" on: repo: luckzhiwei/GCanvas branch: master tags: true ``` When I change the setting below, the deploy stage throw error "GET [https://api.github.com/user:](https://api.github.com/user:) 401 - Bad credentials ". I’m confused about it. Is it that I can’t use environment variables to set api\_key of deploy ---
**Author:** ![BanzaiMan](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/banzaiman/32/67_2.png) [@BanzaiMan](https://travis-ci.community/u/BanzaiMan)\ **Post date:** [November 25, 2019, 1:08pm UTC](https://travis-ci.community/t/401-bad-credentials-for-a-deploy-entry-generated-by-travis-setup-releases/6130/2 "2019-11-25T13:08:37Z")
The value you set in the settings page should not be encrypted. ---
**Author:** ![luckzhiwei](https://avatars.discourse-cdn.com/v4/letter/l/7993a0/32.png) [@luckzhiwei](https://travis-ci.community/u/luckzhiwei)\ **Post date:** [November 26, 2019, 7:27am UTC](https://travis-ci.community/t/401-bad-credentials-for-a-deploy-entry-generated-by-travis-setup-releases/6130/3 "2019-11-26T07:27:08Z")
thank you. I will try to solve it as you say ---
**Author:** ![hpwxf](https://avatars.discourse-cdn.com/v4/letter/h/ce7236/32.png) [@hpwxf](https://travis-ci.community/u/hpwxf)\ **Post date:** [May 7, 2020, 2:21pm UTC](https://travis-ci.community/t/401-bad-credentials-for-a-deploy-entry-generated-by-travis-setup-releases/6130/4 "2020-05-07T14:21:17Z")
Thus, I understand that: - either, you put an awful long encrypted key in your .travis.yml - or, you put an unencrypted key in a travis environment variable, so that if any developer of the GitHub project can add in .travis.yml something like: `echo "${API_TOKEN:0:1}%POISON%${API_TOKEN:1}"` he can get your private API\_TOKEN secret by reading travis logs (even if your variable is not set as “DISPLAY VALUE IN BUILD LOG” since this hack disrupts the usual [secure] replacement in logs) Reminder: since GitHub API\_TOKEN are not restricted by repository, that “bad guy” can do anything with all your repositories (write access and read access to your private repo). ---
**Author:** ![emmt](https://avatars.discourse-cdn.com/v4/letter/e/49beb7/32.png) [@emmt](https://travis-ci.community/u/emmt)\ **Post date:** [May 13, 2020, 5:17pm UTC](https://travis-ci.community/t/401-bad-credentials-for-a-deploy-entry-generated-by-travis-setup-releases/6130/5 "2020-05-13T17:17:41Z")
Your explanations are really clear. Sorry to intervene in this discussion but I have tried the two proposed approches (encrypted token and environment variable with unencrypted token) on a repository of mine and none worked, I still have the “401 - Bad credentials” error (the other parts of the build went good). The log is [here](https://www.travis-ci.com/github/emmt/OptimPackBuilder/builds/165773597). I even tried to give more permissions than just `public_repo` that was automatically set for the GitHub token created by running `travis setup releases`. Any idea of what I could have done wrongly? ---
**Author:** ![native-api](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/native-api/32/430_2.png) [@native-api](https://travis-ci.community/u/native-api)\ **Post date:** [May 13, 2020, 5:39pm UTC](https://travis-ci.community/t/401-bad-credentials-for-a-deploy-entry-generated-by-travis-setup-releases/6130/6 "2020-05-13T17:39:04Z")
To use an envvar for `api_key:`, write smth like this: ```auto # <...> deploy: - <...> api_key: $GITHUB_TOKEN ``` This way is not shown in [https://docs.travis-ci.com/user/deployment/releases/](https://docs.travis-ci.com/user/deployment/releases/) but is shown at e.g. [https://docs.travis-ci.com/user/deployment/pages/](https://docs.travis-ci.com/user/deployment/pages/). They are interchangeable. Introducing an envvar for a one-time-used value like an API key is typically unnecessary compilcation. ---
**Author:** ![emmt](https://avatars.discourse-cdn.com/v4/letter/e/49beb7/32.png) [@emmt](https://travis-ci.community/u/emmt)\ **Post date:** [May 13, 2020, 5:56pm UTC](https://travis-ci.community/t/401-bad-credentials-for-a-deploy-entry-generated-by-travis-setup-releases/6130/7 "2020-05-13T17:56:11Z")
Thanks for the advice. I also tried (unsuccessfully) to use: ```auto api_key: secure: $GITHUB_TOKEN ``` but with the `secure:` keyword (and perhaps this was wrong and I may try without this keyword) and environment variable `GITHUB_TOKEN` set in my Travis-CI settings. I also tried, as suggested in the doc. you have pointed, to just use: ```auto github_token: $GITHUB_TOKEN ``` which also failed. The current `deploy:` section is: ```auto deploy: provider: releases api_key: secure: idp6GpXN1rHR4xl8Alh/3XCbshSoDtbWXoIahyOW0zUTMukSakAAebGnaxFk8yq4UWTs/8VB4JXt01KGIluITwMOCMm+3huIpHFGicqGB7V0MwHJiRiebHj0tUriNb0hQxG2Qa7hFwToQQeoG15297FD3WiIm1Vvm8wDRagAJ1yqOQc3LM8vez0MvyaTac8YxBryuhQXILUgp39+2MBYAoK+uL1qmsaCe4Ey/j8RKOnR/vdwMdmklLvhZ4xPx2mIdvdst1do5mZBT1ZlIS+i0q6JsBQAVOORGgPwlAFcjbEfa6GtYs75HRTRz7wGIH59TrmUe8JFb0oMe03Oo1DELmbpA6o96aMLm0SQ33CMfyishBmgAhtUjZTQnChgHVTrzaJR5wQ8+eLCiihTqRANz3HiUKNyiLITLNnd3EOPeQ3CgYzy0kjVExN3eIsWVh+41tugz3cslZDbJ5aVAsMquJt/CSkFUX0zIHc4y+hBPW6Oi0/gvX/n4JawEaD9EviYHatDWl4o2Y+41mOeQgm6n1/fdUAA+koSvKwrL19coHHgNJRYDgmdVMXRZcSiKVswMUaJcQci2ByH1BGExH+a7vUe0Now7PVQpElbtjgl1+LkcnydVHlTOsj0A8slio1UXAc+uJO5LKZvekKYa74SmM+R3Pv053OqwJtZGnWbvKc= file: products/* on: repo: emmt/OptimPackBuilder skip_cleanup: true ``` and was generated by `travis setup releases`. ---
**Author:** ![native-api](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/native-api/32/430_2.png) [@native-api](https://travis-ci.community/u/native-api)\ **Post date:** [May 13, 2020, 5:59pm UTC](https://travis-ci.community/t/401-bad-credentials-for-a-deploy-entry-generated-by-travis-setup-releases/6130/8 "2020-05-13T17:59:44Z")
> [@401 - Bad credentials (Octokit::Unauthorized)](https://travis-ci.community/t/401-bad-credentials-octokit-unauthorized/5355/2): > > Your credentials are wrong. Since your build runs on [https://travis-ci.com](https://travis-ci.com), you need to use the .com API endpoint to encrypt your API key. Try travis encrypt --pro The need to use the `--pro` option also applies to all other CLI commands that talk to your Travis project entry (which includes all commands that deal with encryption), including `travis setup releases`. ---
**Author:** ![emmt](https://avatars.discourse-cdn.com/v4/letter/e/49beb7/32.png) [@emmt](https://travis-ci.community/u/emmt)\ **Post date:** [May 13, 2020, 7:16pm UTC](https://travis-ci.community/t/401-bad-credentials-for-a-deploy-entry-generated-by-travis-setup-releases/6130/9 "2020-05-13T19:16:31Z")
It worked with the `--pro` tag. Many thanks for your explanations!