"401 Content access is protected by token" authentication failure while performing maven release

Nope, the instructions don’t work.

Please roll-back whatever change was made so that I can continue to publish.

I’m not sure if it’s related, but out of nothing I’m today getting Cannot get stagingProfiles for account (403) although publishing has worked for me last week. I’m already using a token issued from oss.sonatype.org and trying to publish there. Any hints?

Ok, what worked for me was to reset and recreate the user token at https://oss.sonatype.org/ and replace my old tokens with the new ones :+1:t2:

Similar as steinarba:

  1. I can log into https://s01.oss.sonatype.org using my username and my password.
  2. After clicking “Access User Token”, when it says “You have requested an operation which requires validation of your credentials”, I enter the same password and get “Username mismatch”.

I noticed that the dialog at step 2 shows my username lowercase (“nicolas_raoul” instead of “Nicolas_Raoul”). That might be the issue? The username in that dialog unfortunately can not be modified, and modifying it after fiddling with the “readonly” attribute does not do the trick.


EDIT: The next day I tried again and this time it worked. This time I tried logging into https://s01.oss.sonatype.org using my username transformed to lowercase (“nicolas_raoul”), maybe that helped?

I banged my head on this problem for two days. I’m fairly certain the root cause was my skipping the step to publish my gpg key e.g

gpg --keyserver keyserver.ubuntu.com --send-keys XXXXXXX

where XXXXXX is the key I signed my artifacts with.

I also change my github action to post archives to central instead of s01:

      curl --request POST \
            --verbose \
            --header "Authorization: Bearer $SONATYPE_TOKEN" \
            --form bundle=@./api/build/zips/api.zip \
            https://central.sonatype.com/api/v1/publisher/upload

the token is a base64 encoded username:password provided by the user token.

printf username:password | base64

This is publishing without dealing with publish gradle plugins…