When a push fails

A failed push leaves a sentence on the connection and keeps the environment marked as owing one. Nothing is lost and nothing retries into silence: the worker backs off, and the bell says so if it stays broken.

Each of these is a different problem with a different fix, which is why they are not one message.

“Vercel rejected the token”

The token expired, was revoked, or was never valid. Make a new one and connect it again on the Vercel page — a second token for the same account replaces the first, which is what rotating one means.

“Vercel accepted the token and refused the operation”

The token is valid and may not do this. On Vercel that is almost always scope: a token made on a personal account cannot reach a team’s projects, and a read-only token cannot write.

Make the token on the team that owns the project.

“Vercel has no such project, or this token cannot see it”

The same two possibilities, deliberately not told apart — Vercel answers identically for a project that does not exist and one you may not see.

Either the Vercel project was deleted, or the token was replaced with one from an account that cannot reach it. Re-align the project and the list will show you what the current token can actually see.

“Vercel reserves the VERCEL_ prefix”

Vercel injects its own variables with that prefix and refuses to store one you send. kyvlt.sh refuses the whole push rather than writing the keys before it and failing on that one, so nothing is half-written.

Rename the key, or narrow the connection to collections that exclude it.

“Vercel is rate-limiting this token”

Nothing was written. The worker waits until Vercel says the limit resets — their number, not a guess — and tries again.

“This environment’s project is not aligned to a Vercel project”

The alignment was removed while a push was owed. Align the project again, or remove the connection; what is already in Vercel is untouched either way.

A push that stopped part way

A push is not atomic. If the fourth of ten keys is refused, three are written and stay: undoing them would mean removing values a deployment may already have read.

The message names the key that stopped it and how many had been written, and the connection stays marked as owing a push, so fixing the cause and waiting is enough.