How to resolve “refusing to allow an OAuth App to create or update workflow” on git push

I’ve literally just come across this problem when trying to use IntelliJ to push to a branch that contains a GitHub Action workflow (YAML file in .github/workflows). I didn’t find existing resources on the Internet very helpful, so I hope this will help you fix it too.

TL;DR: Update your Personal Access Token with the workflow scope enabled in GitHub, or create a new one, and configure your application to use that.

Background: third-party tools with GitHub integrations like IntelliJ, Visual Studio Code, Github Desktop, etc use tokens to connect to your GitHub account so they can pull/push, etc on your behalf. In the case of IntelliJ, their instructions only say to include the repo, the gist, and the read:org scopes. But you need the workflow scope to modify GitHub Actions.

Here’s how to fix it:

1. In your Github account, go to Settings (in your avatar dropdown in the top right-hand corner)
2. Go to Developer Settings > Personal Access Tokens
3. If your token is listed, update it to include the workflow scope:
   • Click on the token name.
   • Select workflow scope and save.
   • If the app you use won’t re-fetch permissions for your token automatically, you may have to create a new one (step 4 below).
   • Click on Update Token to save the change. DONE!
4. If there’s no token listed there, generate a new one:
   • Click on Generate Token.
   • Select the scopes you need, including workflow.
   • Read the information carefully, then click OK to continue.
   • Copy the new token that Github shows you.
   • Apply the new token to your application. For example, for the Intellij IDE, go to Settings > Version Control > GitHub, remove the existing integration and re-add it, pasting in the new token.