Expired Git provider token in Gitpod: does it block only Git operations or also new workspace and prebuild starts?

Authentication Blast Radius

An expired or revoked Git provider token blocks both new workspace creation and prebuild triggers, in addition to eventually blocking Git operations inside existing workspaces.

New Workspaces and Prebuilds

Because Gitpod requires a valid OAuth token to authorize the initial clone and environment setup, an expired token prevents the platform from initiating the workspace container. Similarly, prebuilds—which rely on the same provider authorization to access the repository—will fail to trigger. These failures occur at the orchestration level before any code is executed in a container.

Existing Workspaces

The impact on running workspaces is delayed. Gitpod issues a short-lived, per-workspace Git credential upon startup. If the primary provider token is revoked while a workspace is already active, Git operations (push, pull, fetch) will continue to function until that specific short-lived credential expires (typically around one hour). Once that window closes, all subsequent Git operations will fail until the user re-authenticates.

Consistency Across Deployments and Providers

This behavior is consistent across GitHub, GitLab, and Bitbucket. While each provider has a different OAuth scope model, Gitpod treats the resulting access token as a generic authorization requirement for its API calls and credential generation.

• Re-authentication: The flow is identical across providers: the user must navigate to Gitpod user settings and reconnect the Git provider account to trigger a new OAuth handshake.
• Self-Managed/Enterprise: The logic remains the same in self-managed deployments. Although the OAuth application is registered by a cluster administrator rather than Gitpod's hosted service, the token storage and expiry lifecycle are handled identically.

Verification Steps

To verify this behavior in your specific environment, you can use the following scoped tests:

1. Test Workspace Persistence: Launch a workspace, then revoke the Gitpod OAuth grant in your provider's settings. Attempt a git fetch; it should succeed for a short window and then fail.
2. Test Orchestration Block: With the token revoked, attempt to start a new workspace from a repository URL. Gitpod should return an authentication error before the container starts.
3. Test Prebuilds: Trigger a prebuild via the dashboard or a commit; it should fail to initiate.

Assumption: This guidance assumes a modern Gitpod version (v0.5+). In legacy versions, workspace credentials were not short-lived, meaning provider token revocation would cause immediate failure of in-workspace Git commands.