Random API Error: 401 Unauthorized

[nicdub]

What happened?

Hello,

First, thank you to all the contributors for making available this great script!

For the past few days, even though I do have the rights, I've been regularly getting random 401 Unauthorized causing the backup to stop:

2026-07-10T10:11:03.506: Requesting https://api.github.com/repos/myorg/myproj/issues/80/events?per_page=100
2026-07-10T10:11:03.736: API Error: 401 Unauthorized for https://api.github.com/repos/myorg/myproj/issues/80/events?per_page=100

Traceback (most recent call last):  File "/app/.venv/bin/github-backup", line 10, in <module>    sys.exit(main())
             ^^^^^^
  File "/app/.venv/lib/python3.12/site-packages/github_backup/cli.py", line 83, in main
    backup_repositories(args, output_directory, repositories)
  File "/app/.venv/lib/python3.12/site-packages/github_backup/github_backup.py", line 2137, in backup_repositories
    backup_issues(args, repo_cwd, repository, repos_template)
  File "/app/.venv/lib/python3.12/site-packages/github_backup/github_backup.py", line 2559, in backup_issues
    issues[number]["event_data"] = retrieve_data(args, template)
                                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/.venv/lib/python3.12/site-packages/github_backup/github_backup.py", line 856, in retrieve_data
    return list(fetch_all())
           ^^^^^^^^^^^^^^^^^
  File "/app/.venv/lib/python3.12/site-packages/github_backup/github_backup.py", line 759, in fetch_all
    http_response = make_request_with_retry(
                    ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/.venv/lib/python3.12/site-packages/github_backup/github_backup.py", line 954, in make_request_with_retry
    return urlopen(request, context=https_ctx)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/urllib/request.py", line 215, in urlopen
    return opener.open(url, data, timeout)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/urllib/request.py", line 521, in open
    response = meth(req, response)
               ^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/urllib/request.py", line 630, in http_response
    response = self.parent.error(
               ^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/urllib/request.py", line 559, in error
    return self._call_chain(*args)
           ^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/urllib/request.py", line 492, in _call_chain
    result = func(*args)
             ^^^^^^^^^^^
  File "/usr/local/lib/python3.12/urllib/request.py", line 639, in http_error_default
    raise HTTPError(req.full_url, code, msg, hdrs, fp)
urllib.error.HTTPError: HTTP Error 401: Unauthorized

I added the status 401 in the retryable status_code and it seems to fix the problem but not sure if this is the recommended way.

2026-07-10T12:01:01.626: Requesting https://api.github.com/repos/myorg/myproj/issues/310/events?per_page=100
2026-07-10T12:01:01.895: HTTP 401 (Unauthorized), retrying in 1.1s (attempt 1/6) for https://api.github.com/repos/myorg/myproj/issues/310/events?per_page=100                     │
2026-07-10T12:01:03.625: Requesting https://api.github.com/repos/myorg/myproj/issues/309/comments?per_page=100

[Iamrodos]

I would not recommend making 401 retry in a blanket way.

Was this something that just started on your account? Still happening? Are you generating the token just before executing? I found some references to others getting intermittent 401's against the gh API where a retry worked.

Several invalid-credential requests in a short window trigger a temporary account-level lockout (403 for all auth attempts, even valid ones). With a genuinely bad token, blind retries make things worse, and a typo’d token would take ~a minute of backoff to fail instead of failing instantly.

A safer version of the same idea: retry 401 only when the token has already authenticated successfully this run. Since main() calls get_authenticated_user() at startup, any later 401 is near-certainly transient. A small “auth validated” flag set after the first successful authenticated response would gate the retry.

If the problem is ongoing or widespread it might be worth a PR.