! [remote rejected] … (refusing to allow a Personal Access Token to create or update workflow `.github/workflows/x.yml` without `workflow` scope)
Your token can’t modify GitHub Actions workflow files without the workflow scope.
Exact message you may see
without `workflow` scoperefusing to allow a Personal Access Token to create or update workflow
Seen on:
Git
Meaning
Pushing changes under .github/workflows requires a classic PAT with the workflow scope, or a fine-grained token with Workflows write permission.
Common causes
- PAT without workflow scope
- OAuth app token without workflow permission
⚡ Quick fix
- Regenerate the token with the workflow scope
- Use gh auth refresh -s workflow
Detailed fix by platform
Git
gh auth refresh -h github.com -s workflow
How to diagnose
- Token — Scopes include workflow?
- Recent change — Did it start after a deploy, upgrade, or configuration change? Compare with the last working version.
🔧 Still not fixed?
Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:
Similar errors
Most viewed in Git
- Git SSL certificate problem fatal: unable to access 'https://…': SSL certificate problem: unable to get local issuer certificate
- unfinished merge fatal: You have not concluded your merge (MERGE_HEAD exists). Please, commit your changes before you merge.
- kex_exchange_identification kex_exchange_identification: Connection closed by remote host
Other ways to find it
Where this error sits
Origin: Build & delivery. Errors that are often confused with or caused by this one (click to open):
🧠 Still stuck? Analyze your error
Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.
💬 What worked for others
No tips yet — did something else fix this for you?
Share what worked for you
Tips are checked by an editor before they appear. Links are removed.
Did this fix work for you?
Report a correction or suggest an improvement
Last updated 12 Oct 2026