How to fix remote: TF401019: The personal access token has expired in Git

GitBEGINNERMEDIUMUpdated Dec 6, 2025· 259 views

The TF401019 error occurs when your Azure DevOps Personal Access Token (PAT) has expired. This blocks Git operations like push, pull, and clone. The fix involves generating a new PAT in Azure DevOps and updating your stored credentials.

Quick fix

Fixes TF401019

# Store your new PAT somewhere secure (password manager recommended)
# You'll need it in the next steps
  1. Generate a new Personal Access Token in Azure DevOps
  2. Clear expired credentials from Windows Credential Manager
  3. Authenticate with your new PAT
  4. Update service connections in Azure Pipelines
git — error
# Store your new PAT somewhere secure (password manager recommended)
# You'll need it in the next steps
remote: TF401019: The personal access token has expired

What this error means

This error indicates that the Personal Access Token (PAT) you're using to authenticate with Azure DevOps has passed its expiration date. Azure DevOps PATs are time-limited credentials that expire after a configurable period (from one day to one year), and once expired, they can no longer be used for authentication. When you perform Git operations (push, pull, clone, fetch) against an Azure DevOps repository over HTTPS, Git uses your stored credentials to authenticate. If those credentials include an expired PAT, Azure DevOps rejects the authentication attempt and returns the TF401019 error. The error commonly appears in several scenarios: 1. **Local development** - When pushing or pulling from the command line 2. **CI/CD pipelines** - When automated builds try to access repositories 3. **IDE integrations** - When Visual Studio, VS Code, or other tools access Azure DevOps 4. **Service connections** - When external services integrate with Azure DevOps repos Microsoft recommends keeping PAT lifespans short (ideally weekly or less) for security reasons, which means this error is relatively common in active development environments.

Typical symptoms

  • Git push, pull, or fetch fails with 'TF401019: The personal access token has expired'
  • Azure DevOps pipelines fail during repository checkout
  • IDE shows authentication failure when syncing with Azure DevOps
  • Git clone of Azure DevOps repository returns authentication error
  • Previously working Git commands suddenly fail
  • Service connections report expired token errors
  • Automated builds fail at the 'Get sources' step
  • Error message includes 'remote: TF401019' prefix

Common causes

  1. Personal Access Token (PAT) has reached its configured expiration date
  2. PAT was created with a short lifespan and not renewed
  3. User hasn't signed in with the PAT within 90 days (for Microsoft Entra-backed organizations)
  4. PAT was manually revoked in Azure DevOps
  5. Cached credentials in Windows Credential Manager contain an old expired token
  6. Service connection in Azure Pipelines uses an expired PAT
  7. Token was created for a different organization or has incorrect scope
  8. Organization security policies enforce shorter token lifespans

How to fix "remote: TF401019: The personal access token has expired"

1Generate a new Personal Access Token in Azure DevOps

Create a new PAT to replace the expired one:

1. Sign in to Azure DevOps at https://dev.azure.com/{your-organization}
2. Click your profile icon (top right) > Personal access tokens
3. Click + New Token
4. Configure the token:
 - Name: Descriptive name (e.g., "Development laptop - Git access")
 - Organization: Select your organization
 - Expiration: Choose duration (Microsoft recommends weekly, but 90 days is common)
 - Scopes: Select Code > Read & write (or Full for complete access)
5. Click Create
6. Copy the token immediately - you won't be able to see it again!

plaintext
# Store your new PAT somewhere secure (password manager recommended)
# You'll need it in the next steps

Tip: Consider setting a calendar reminder a few days before expiration to avoid this error recurring.

2Clear expired credentials from Windows Credential Manager

Remove the old cached credentials so Git will prompt for the new token:

Using Windows GUI:
1. Press Windows key and search for Credential Manager
2. Click Windows Credentials
3. Look for entries starting with:
 - git:https://dev.azure.com/{organization}
 - git:https://{organization}@dev.azure.com
 - git:https://{organization}.visualstudio.com
4. Click each entry and select Remove

Using Command Line:

powershell
# List all credentials
cmdkey /list

# Delete Azure DevOps credentials (adjust the target name as needed)
cmdkey /delete:git:https://dev.azure.com/your-organization
cmdkey /delete:LegacyGeneric:target=git:https://dev.azure.com/your-organization

# Alternative: Delete all Git credentials for Azure DevOps
cmdkey /list | Select-String "dev.azure.com" | ForEach-Object {
    $target = ($_ -split ":")[1].Trim()
    cmdkey /delete:$target
}

After removing credentials, your next Git operation will prompt for authentication.

3Authenticate with your new PAT

Use your new token for Git authentication:

When prompted for credentials:

bash
# Run any Git command that requires authentication
git fetch origin

# When prompted:
# Username: your-email@company.com (or your Azure DevOps username)
# Password: paste-your-new-PAT-here

Embedding token in the remote URL (for testing):

bash
# Check current remote
git remote -v

# Temporarily test with embedded token
git ls-remote https://your-pat@dev.azure.com/org/project/_git/repo

Clone with PAT:

bash
# Clone using PAT in URL (don't commit this!)
git clone https://your-pat@dev.azure.com/org/project/_git/repo

Configure credential caching:

bash
# Use Git Credential Manager (recommended)
git config --global credential.helper manager

# Or cache for a specific time (1 hour = 3600 seconds)
git config --global credential.helper 'cache --timeout=3600'
4Update service connections in Azure Pipelines

If the error occurs in CI/CD pipelines, update the service connection:

1. Go to Project Settings > Service connections
2. Find the affected service connection (usually type "Azure Repos/Team Foundation Server")
3. Click the connection name > Edit
4. Update the Password/PAT field with your new token
5. Click Save

For YAML pipelines using checkout:

yaml
# If using a service connection
resources:
  repositories:
    - repository: MyRepo
      type: git
      name: Project/RepoName
      endpoint: MyServiceConnection  # Update this service connection

steps:
  - checkout: MyRepo

Alternative - Use system access token:

yaml
steps:
  - checkout: self
    persistCredentials: true

  - script: |
      git -c http.extraheader="AUTHORIZATION: bearer $(System.AccessToken)" fetch
    displayName: 'Git operations with system token'

This uses the pipeline's built-in token which doesn't expire like personal PATs.

5Clear credentials on macOS and Linux

If you're on macOS or Linux, clear credentials differently:

On macOS (Keychain):

bash
# Remove Azure DevOps credentials
git credential-osxkeychain erase
host=dev.azure.com
protocol=https
# Press Enter twice

# Or use Keychain Access app:
# 1. Open Keychain Access
# 2. Search for "dev.azure.com"
# 3. Delete matching entries

On Linux:

bash
# Check your credential helper
git config --global credential.helper

# If using 'store' (plain text file)
# Edit or remove entries from ~/.git-credentials
nano ~/.git-credentials
# Remove lines containing dev.azure.com

# If using 'cache', exit the cache daemon
git credential-cache exit

# If using libsecret (GNOME)
# Open "Passwords and Keys" (Seahorse) and remove Azure DevOps entries

Test authentication:

bash
# Force re-authentication
GIT_TERMINAL_PROMPT=1 git fetch origin

# Enter your new PAT when prompted
6Configure Git Credential Manager for Azure DevOps

Git Credential Manager (GCM) handles Azure DevOps authentication automatically:

Install GCM:

bash
# Windows: Included with Git for Windows

# macOS
brew install git-credential-manager

# Linux (Debian/Ubuntu)
curl -LO https://github.com/git-ecosystem/git-credential-manager/releases/latest/download/gcm-linux_amd64.deb
sudo dpkg -i gcm-linux_amd64.deb

Configure for Azure DevOps:

bash
# Set GCM as credential helper
git config --global credential.helper manager

# Enable Azure DevOps-specific features
git config --global credential.azreposCredentialType oauth

# Alternative: Force PAT-based authentication
git config --global credential.azreposCredentialType pat

GCM benefits:
- Automatic token refresh (for OAuth)
- Secure credential storage
- Multi-account support
- Browser-based authentication option

bash
# Trigger interactive login
git credential-manager azure-repos login

# List configured credentials
git credential-manager list
7Set up automatic PAT rotation reminders

Prevent future expiration issues with proactive management:

Azure DevOps notifications:
- Azure DevOps sends email notifications 7 days before PAT expiration
- Ensure your notification settings are enabled: User Settings > Notifications

Track PAT expiration:

bash
# View your PATs and their expiration dates
# Navigate to: https://dev.azure.com/{org}/_usersSettings/tokens

Best practices:
1. Use descriptive names - Include the purpose and machine name
2. Set appropriate lifespans - Balance security vs. convenience
3. Use minimum required scopes - Only grant permissions you need
4. Document your PATs - Track where each PAT is used
5. Use managed identities - For Azure-hosted services when possible

Consider alternatives:
- OAuth - GCM supports browser-based OAuth flow
- SSH keys - Don't expire (unless you configure expiration)
- Managed identities - For Azure VMs and services
- Service principals - For automation scenarios

bash
# Switch to SSH authentication
git remote set-url origin git@ssh.dev.azure.com:v3/org/project/repo

# Test SSH connection
ssh -T git@ssh.dev.azure.com

Advanced notes

### Understanding Azure DevOps Authentication Methods

Azure DevOps supports multiple authentication mechanisms:

| Method | Best For | Expiration |
|--------|----------|------------|
| PAT | Local development, CI/CD | Configurable (1 day - 1 year) |
| OAuth | Interactive applications | Token refresh available |
| SSH Keys | Developer workstations | No expiration by default |
| Managed Identity | Azure-hosted resources | No credentials to manage |
| Service Principal | Automated processes | Certificate-based |

### Microsoft Entra ID (Azure AD) Backed Organizations

For organizations using Microsoft Entra ID:

bash
# PATs must be used within 90 days of creation or they become inactive
# Even if the expiration date is further in the future

# To reactivate, sign in to Azure DevOps through the browser first
# Then re-use your PAT

### CI/CD Pipeline Best Practices

For Azure Pipelines, avoid using personal PATs when possible:

yaml
# Use the built-in System.AccessToken (no expiration concerns)
steps:
  - checkout: self
    persistCredentials: true

  - script: |
      git push https://$(System.AccessToken)@dev.azure.com/org/project/_git/repo
    displayName: 'Push changes'
    env:
      GIT_TERMINAL_PROMPT: 0

### Troubleshooting Persistent Issues

If the error persists after updating credentials:

bash
# Enable verbose Git output
GIT_TRACE=1 GIT_CURL_VERBOSE=1 git fetch origin 2>&1

# Check credential helper configuration
git config --list --show-origin | grep -i cred

# Verify remote URL format
git remote -v
# Should be: https://dev.azure.com/org/project/_git/repo
# Or: https://org.visualstudio.com/project/_git/repo (legacy)

### Organization Policy Considerations

Administrators can set PAT policies:
- Maximum PAT lifespan
- Required scopes for new PATs
- Restriction of PAT creation

Check with your administrator if you're unable to create PATs with your desired settings.

### Revoking Compromised PATs

If you suspect a PAT has been compromised:

1. Go to User Settings > Personal Access Tokens
2. Find the token and click Revoke
3. Generate a new PAT immediately
4. Update all services using the old token

### Using az devops CLI

bash
# Install Azure CLI with DevOps extension
az extension add --name azure-devops

# Login (uses browser)
az login

# Set default organization
az devops configure --defaults organization=https://dev.azure.com/YourOrg

# Clone using CLI authentication
az repos clone --repository RepoName

Frequently asked questions

What does "TF401019" mean?
This error indicates that the Personal Access Token (PAT) you're using to authenticate with Azure DevOps has passed its expiration date. Azure DevOps PATs are time-limited credentials that expire after a configurable period (from one day to one year), and once expired, they can no longer be used for authentication. When you perform Git operations (push, pull, clone, fetch) against an Azure DevOps repository over HTTPS, Git uses your stored credentials to authenticate.
How do I fix "TF401019"?
The TF401019 error occurs when your Azure DevOps Personal Access Token (PAT) has expired. This blocks Git operations like push, pull, and clone. The fix involves generating a new PAT in Azure DevOps and updating your stored credentials.
What causes "TF401019"?
Personal Access Token (PAT) has reached its configured expiration date PAT was created with a short lifespan and not renewed User hasn't signed in with the PAT within 90 days (for Microsoft Entra-backed organizations)
Is the "TF401019" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading