Static Web Apps: deploymentAuthPolicy stuck on "GitHub" (OIDC), can't switch back to DeploymentToken — GitHub Actions deploy fails with "api key was invalid"

Question

Static Web Apps: deploymentAuthPolicy stuck on "GitHub" (OIDC), can't switch back to DeploymentToken — GitHub Actions deploy fails with "api key was invalid"

ZenixHub Labs 5

I have a Static Web App (Free tier) connected to a GitHub repo, deploying via the classic

Azure/static-web-apps-deploy@v1 action with azure_static_web_apps_api_token set from a

GitHub secret. Every deployment now fails at the "Build And Deploy" step with:

The content server has rejected the request with: BadRequest

Reason: No matching Static Web App was found or the api key was invalid.

What I've already tried:

Reset the deployment token from the Portal ("Manage deployment token" > Reset) and updated the GitHub secret — same error.
Reset it again via az staticwebapp secrets reset-api-key, confirmed the new key was correctly fetched and pushed to the GitHub secret — same error persists regardless of how fresh the token is.

Root cause found via:

az rest --method get --url "https://management.azure.com/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Web/staticSites/<name>?api-version=2023-01-01"

"properties.deploymentAuthPolicy" is set to "GitHub" (OIDC-based), not "DeploymentToken".

This explains why every static token is rejected outright — the resource stopped accepting

token-based auth entirely.

I tried to PATCH it back:

az rest --method patch --url ".../staticSites/<name>?api-version=2023-01-01" \

--body '{"properties":{"deploymentAuthPolicy":"DeploymentToken","repositoryToken":"<PAT with repo+workflow scope>"}}'

This still returns:

"DeploymentAuthPolicy is invalid. Cannot update policy without providing repository token."

Questions:

What's the supported way to switch an existing Static Web App from GitHub-OIDC deploymentAuthPolicy back to classic DeploymentToken auth?
Is there a specific PAT scope/format expected for repositoryToken that differs from a standard classic PAT with repo + workflow scopes?
The Azure Portal doesn't show any toggle for this on the Overview / "Manage deployment token" page for this resource — is that setting exposed anywhere in the Portal UI, or is API/CLI the only way?

Abhinaba Das 115 Reputation points Microsoft External Staff Moderator

2026-08-17T23:26:37.95+00:00

Thank you for contacting us about the Deployement issue We have begun looking into it and will share our suggestions with you as soon as possible. If you have any additional details or concerns in the meantime, please let us know. We appreciate your patience while we work on this
Abhinaba Das 115 Reputation points Microsoft External Staff Moderator

2026-08-19T22:42:24.3933333+00:00

Hi @ZenixHub Labs

I apologize for the late response.

Thanks for providing the detailed troubleshooting and the deploymentAuthPolicy value. Based on the behavior described, the deployment token itself may not be the issue if the Static Web App is currently configured with the GitHub deployment authorization policy.

Microsoft documents two deployment authorization policies for Static Web Apps: Azure deployment token and GitHub access token. For an existing Static Web App, the documented location to change this is:

Static Web App → Settings → Configuration → Deployment configuration → Deployment authorization policy

If the policy is changed back to the Azure deployment-token option, the existing AZURE_STATIC_WEB_APPS_API_TOKEN GitHub secret can then be updated with the newly reset deployment token.

Since you are not seeing the Deployment configuration setting in the Portal, could you confirm whether Settings → Configuration → Deployment configuration is completely missing for this Static Web App? If it is missing, that would be worth investigating separately rather than continuing to reset the deployment token.

I would also avoid changing the repositoryToken/PAT scopes for now, since the immediate deployment failure is consistent with a mismatch between the authorization policy configured on the Static Web App and the authentication method used by the workflow.

Reference:

https://learn.microsoft.com/en-us/azure/static-web-apps/build-configuration?utm_source=chatgpt.com

https://learn.microsoft.com/en-us/azure/static-web-apps/deployment-token-management?utm_source=chatgpt.com

Kindly let us know if the above helps or if you need further assistance on this issue.

Please upvote if the information was helpful—this helps others in the community as well.
Abhinaba Das 115 Reputation points Microsoft External Staff Moderator

2026-08-27T19:32:50.35+00:00

Hi @ZenixHub Labs

Just following up to see if you had a chance to review my earlier comment.

1 answer

Your answer

Abhinaba Das 115 Reputation points Microsoft External Staff Moderator

2026-08-17T23:26:37.95+00:00

Thank you for contacting us about the Deployement issue We have begun looking into it and will share our suggestions with you as soon as possible. If you have any additional details or concerns in the meantime, please let us know. We appreciate your patience while we work on this
Abhinaba Das 115 Reputation points Microsoft External Staff Moderator

2026-08-19T22:42:24.3933333+00:00

Hi @ZenixHub Labs

I apologize for the late response.

Thanks for providing the detailed troubleshooting and the deploymentAuthPolicy value. Based on the behavior described, the deployment token itself may not be the issue if the Static Web App is currently configured with the GitHub deployment authorization policy.

Microsoft documents two deployment authorization policies for Static Web Apps: Azure deployment token and GitHub access token. For an existing Static Web App, the documented location to change this is:

Static Web App → Settings → Configuration → Deployment configuration → Deployment authorization policy

If the policy is changed back to the Azure deployment-token option, the existing AZURE_STATIC_WEB_APPS_API_TOKEN GitHub secret can then be updated with the newly reset deployment token.

Since you are not seeing the Deployment configuration setting in the Portal, could you confirm whether Settings → Configuration → Deployment configuration is completely missing for this Static Web App? If it is missing, that would be worth investigating separately rather than continuing to reset the deployment token.

I would also avoid changing the repositoryToken/PAT scopes for now, since the immediate deployment failure is consistent with a mismatch between the authorization policy configured on the Static Web App and the authentication method used by the workflow.

Reference:

https://learn.microsoft.com/en-us/azure/static-web-apps/build-configuration?utm_source=chatgpt.com

https://learn.microsoft.com/en-us/azure/static-web-apps/deployment-token-management?utm_source=chatgpt.com

Kindly let us know if the above helps or if you need further assistance on this issue.

Please upvote if the information was helpful—this helps others in the community as well.
Abhinaba Das 115 Reputation points Microsoft External Staff Moderator

2026-08-27T19:32:50.35+00:00

Hi @ZenixHub Labs

Just following up to see if you had a chance to review my earlier comment.

Answer 1

The supported portal path for this setting is Settings > Configuration > Deployment configuration on the Static Web App resource. That is the documented place to choose the deployment authorization policy for an existing app. The Overview > Manage deployment token page is only for retrieving or resetting the token, not for changing the authorization policy.

For an existing app:

Open the Static Web App in Azure portal.
Go to Settings > Configuration > Deployment configuration.
Change the Deployment authorization policy to Azure deployment token.
Save the change.
Go back to Overview > Manage deployment token.
Select Reset token.
Copy the new token.
In GitHub, open the repository Settings > Security > Actions.
Update the AZURE_STATIC_WEB_APPS_API_TOKEN... repository secret with the new token.
Rerun the workflow.

If the workflow file targets a different branch than intended, update the branch names in the GitHub workflow. For some apps created during the preview period, changing the branch can also require resetting the deployment token.

On the specific repositoryToken PAT scope/format question, the available documentation only states that Static Web Apps supports either an Azure deployment token or a GitHub access token as deployment authorization policies. It does not provide a supported PAT scope/format matrix for repositoryToken in the management API.

On the API/CLI question, the documented UI for changing the policy is the Azure portal path above. The provided documentation does not describe a supported CLI or REST-only requirement for switching the policy.