GitHub Actions GITHUB_TOKEN "cannot access another repository"

By Daniel Zoghalchali·Latchkey

The automatic GITHUB_TOKEN is scoped to the repository running the workflow. Any call targeting a different repo (clone, dispatch, API write) returns 403/404 because the token has no rights outside its own repo.

What this error means

A step touching a second repository fails with not found or resource not accessible while same-repo calls work.

github-actions

RequestError [HttpError]: Not Found
The GITHUB_TOKEN is scoped to this repository and cannot access another repository.
    status: 404

Diagnose it: what token do you actually have?

Permission failures in Actions are almost never about your repository settings alone. Three things combine: the default GITHUB_TOKEN permission set for the repo or organization, the permissions: block in the workflow, and whether the event is a fork pull request, which downgrades the token to read-only regardless of everything else.

.github/workflows/ci.yml

- name: Show the token scopes actually granted
  run: |
    curl -sI -H "Authorization: Bearer $GITHUB_TOKEN" \
      https://api.github.com/ | grep -i "^x-oauth-scopes\|^x-accepted"
    echo "event: ${{ github.event_name }}"
    echo "fork PR: ${{ github.event.pull_request.head.repo.fork }}"
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Common causes

Cross-repo access with GITHUB_TOKEN

GITHUB_TOKEN permissions do not extend beyond the workflow repository by design.

How to fix it

Use a dedicated credential for the other repo

Create a GitHub App installation token or a fine-grained PAT with access to the target repo.
Store it as a secret and pass it to the cross-repo step instead of GITHUB_TOKEN.

.github/workflows/sync.yml

- uses: actions/checkout@v4
  with:
    repository: org/other-repo
    token: ${{ secrets.CROSS_REPO_TOKEN }}

Grant the narrowest permission that works

Declaring a permissions: block switches the job from the repository default to exactly what you list, so an incomplete block is a common cause of a new failure right after someone tightened security. List every scope the job needs, not just the one that failed.

.github/workflows/ci.yml

permissions:
  contents: read        # checkout
  packages: write       # push to GHCR
  id-token: write       # OIDC to a cloud provider
  pull-requests: write  # comment on or label a PR
  checks: write         # publish check runs

How to prevent it

Reserve GITHUB_TOKEN for same-repo operations.
Use a least-privilege App token for cross-repo automation.

Frequently asked questions

What causes GitHub Actions GITHUB_TOKEN "cannot access another repository"?

cross-repo access with github_token. GITHUB_TOKEN permissions do not extend beyond the workflow repository by design.

How do I fix GitHub Actions GITHUB_TOKEN "cannot access another repository"?

Use a dedicated credential for the other repo. Create a GitHub App installation token or a fine-grained PAT with access to the target repo.

What does GitHub Actions GITHUB_TOKEN "cannot access another repository" actually mean?