I am seeing contradictory Personal Access Token behavior on a Vercel Hobby account. Dashboard/browser authentication otherwise works, and our repository uses Vercel CLI 59.1.4.
Latest reproduction
- Open the authenticated token creation UI.
- Choose a team-scoped PAT covering that team's projects.
- Set a one-hour lifetime.
- Click Create once.
- The UI reports:
An error occurred while creating token. Please try again later. - No credential value is displayed.
- The same open browser state later shows
Token Created, still with no accessible credential. - Close the dialog and check the fully loaded
Alltoken list three times, approximately three seconds apart. - The exact named token is absent each time.
I cannot determine whether the provider transaction created an internal resource, so I am not claiming success or failure. No token was available for an API test.
Separate earlier observation
On the previous day, a different fresh PAT selected as Full Account / Non-SAML
reached GET /v2/user and returned HTTP 403. The test stopped immediately and
that token was revoked. I do not know whether the two observations share a root
cause.
Vercel Status showed no incident on either day, and the August 26 CLI-login incident had already been resolved.
Public reports appear inconsistent. Vercel CLI issue #17506 shows a
team-scoped token returning 2xx for user/team/project while a project-scoped
token fails user/team checks. A recent Hobby community thread reports a case
where Full Account worked but strict team scope did not pass /v2/user.
Could Vercel clarify the current authoritative PAT scope contract for CLI 59.1.x?
- Should a team-scoped PAT be able to call
GET /v2/user? - Does Full Account automatically include joined/owned teams?
- Is
Non-SAMLinformational on Hobby? - Is the contradictory Create/Token Created state a known PAT issuance issue?
- Is any provider-side cleanup required when no credential and no token-list row are visible?
- What is the safest next single verification without creating multiple tokens?
I will not post token values, account email, team/project IDs, private repository details or browser-session data.