Sourcetree shows generic Authentication failed error for expired personal access token

Short answer

No. As of current Sourcetree releases there is no setting, environment variable, or credential-helper option that makes Sourcetree display a distinct "token expired" message. Sourcetree delegates HTTPS authentication to the underlying Git client and the OS credential store (Keychain on macOS, Credential Manager on Windows), and simply forwards whatever Git reports. When a PAT is expired, the server returns the same HTTP 401 it returns for any invalid credential, so Sourcetree has nothing more specific to show.

Why the message is generic

Two layers collapse the detail before it reaches the dialog:

• The server side: Most Git hosts (GitHub, GitLab, Bitbucket) answer an expired or revoked PAT with a plain 401. Some include a hint in the response body (for example, GitLab may return remote: Invalid access token), but the HTTP status itself does not distinguish "expired" from "wrong password" or "insufficient scope."
• Sourcetree's UI: Sourcetree does not parse the response body for expiration hints. It surfaces Git's stderr as a generic authentication failure and re-prompts for credentials.

This is confirmed behavior of the credential flow, not a misconfiguration on your machine.

What the log can and cannot tell you

Sourcetree's log (Help → Show Log, or View → Show Log depending on platform/version) records the raw Git command output. You will see the 401 failure there, but Sourcetree does not annotate it as an expiration. The log is useful for confirming which remote and credential helper were involved, not for diagnosing token state.

How to confirm expiration in under a minute

Run the same operation from a terminal, which exposes the server's full message:

git ls-remote https://gitlab.example.com/group/repo.git

If the host prints something like remote: Invalid access token, the token is dead rather than, say, a scope or account problem. You can also query the host's API directly:

curl -i -H "PRIVATE-TOKEN: $TOKEN" https://gitlab.example.com/api/v4/user

A 401 here confirms the token itself is rejected. Avoid pasting the token into shared logs or shell history on multi-user systems.

Work-arounds for clearer expiry feedback

• Custom credential helper: A helper script can validate the stored token against the host's API before returning it and emit a specific message on expiry. This works, but adds maintenance and must be trusted, since helpers handle secrets. Scope the validation to a read-only endpoint like /api/v4/user.
• Least-privilege, short-lived tokens: Issue a PAT with only the scopes the remote needs (e.g., read_repository/write_repository) and a calendar reminder before its expiry date. When it expires, replace it through Sourcetree's credential prompt or by deleting the entry in Keychain/Credential Manager so Sourcetree re-prompts.
• OAuth where supported: For hosts where Sourcetree offers an OAuth account type, sign-in flows can produce clearer re-auth prompts than PATs, though Sourcetree does not silently refresh expired OAuth tokens either.

Caveats

Exact dialog text and log location vary by Sourcetree version and OS, and host-specific 401 body messages change over time. Verify against your Sourcetree release and Git host before scripting around the messages above.