# Maven "Could not transfer artifact ... 401/403" - Fix Repo Auth

> Fix Maven "Could not transfer artifact ... authentication failed ... 401/403" in CI - a private repo rejecting the request because settings.xml has no matching, valid server credentials.

Source: https://latchkey.dev/learn/java-jvm/maven-could-not-transfer-401-403  
Updated: 2026-06-26

Maven reached the private repository but was refused with a 401 (not authenticated) or 403 (authenticated, not allowed). The credentials in settings.xml are missing, wrong, or do not match the repository id.

## Diagnose it: resolve the effective POM first

Maven merges parent POMs, profiles, and settings before it builds anything. The configuration causing your failure is frequently inherited or activated by a profile that is on locally and off in CI.

```Terminal
# the fully resolved configuration Maven will actually use
mvn help:effective-pom | head -60

# which profiles are active here vs on your machine?
mvn help:active-profiles

# full error, offline-safe, no colour codes to confuse the log
mvn -B -e -X <goal> 2>&1 | tail -60
```

> Always pass `-B` (batch mode) in CI. Without it Maven emits interactive progress output that bloats logs and can hang on a prompt.

## FAQ

### What causes Maven "Could not transfer artifact ... 401/403"?

There are 2 common causes: repository id does not match a <server> id and token missing, stale, or wrong scope. Maven binds credentials to a repo by id.

### How do I fix Maven "Could not transfer artifact ... 401/403"?

There are 2 fixes depending on which cause you have: write a settings.xml from ci secrets and pass it explicitly and match ids and verify the token scope. Work through them in order, since the first is the most common.

### What does Maven "Could not transfer artifact ... 401/403" actually mean?

Resolution against a private Nexus/Artifactory fails with Could not transfer artifact ...

### How do I stop Maven "Could not transfer artifact ... 401/403" happening again?

Keep repository and server ids identical, inject tokens from CI secrets at build time, and scope read vs write tokens separately.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt