Our Concourse pipelines recently started failing SonarQube Cloud analysis with:
Not authorized or project not found
We are using an active scoped organization token with no expiry. The project key and organization key are correct, and the token shows recent usage.
We previously saw a similar issue where scoped organization tokens were rejected when used with Basic Auth, while Bearer Auth worked. Broken: APIs stopped accepting organization tokens in Basic Auth
Is this the same known issue, and are scoped organization tokens currently supported with the Concourse SonarQube resource?
Joe
June 16, 2026, 9:03pm
2
Hello,
Please note this announcement: Removing sonar.login from SonarQube Cloud on June 11, 2026
Technically, it occurred starting today, not June 11. Can you check that you are using sonar.token and not sonar.login with your scoped organization token?
Hello @GloriaParker ,
Our Concourse pipelines recently started failing SonarQube Cloud analysis with:
We’d like to check with you if your analyses target our US instance, as in https://sonarqube.us ?
I’ll also be happy to review your logs if you’ll send 'em over. Redacted is OK, but hopefully not too much.
--
Best regards,
Wayne
Hello @GloriaParker ,
If you were targeting https://sonarqube.us/ with our Jenkins plugin, we’d like to share that v2.18.3 addresses an issue where it uses sonar.login, a property that is no longer supported since June 16: Index of public/org/jenkins-ci/plugins/sonar/2.18.3 .
Joe
June 18, 2026, 7:31pm
6
Hello @GloriaParker ,
Are you using this GitHub repo GitHub - cathive/concourse-sonarqube-resource: performs SonarQube analyses and checks quality gates https://concourse-ci.org/ https://sonarqube.org/ · GitHub ? If so, I can see in their README that it references sonar.login and in its source code:
scanner_opts+=" -Dsonar.host.url=${sonar_host_url}"
sonar_organization=$(jq -r '.source.organization // ""' < "${payload}")
if [[ -n "${sonar_organization}" ]]; then
scanner_opts+=" -Dsonar.organization=\"${sonar_organization}\""
fi
sonar_login=$(jq -r '.source.login // ""' < "${payload}")
if [[ -n "${sonar_login}" ]]; then
scanner_opts+=" -Dsonar.login=\"${sonar_login}\""
fi
sonar_password=$(jq -r '.source.password // ""' < "${payload}")
if [[ -n "${sonar_password}" ]]; then
scanner_opts+=" -Dsonar.password=\"${sonar_password}\""
fi
# Try to determine Maven settings configuration.
# If they have been defined inline, they take precedence over a possibly specified
# maven settings file.
Please notify the maintainers that sonar.login is deprecated. For now, you need to use sonar.token and set this value to your auth token. I believe you can pass it through additional_sonar_scanner_opts.