diff --git a/generate-ci-auth-file b/generate-ci-auth-file
index 3f0c53dd3..311eea1d2 100755
--- a/generate-ci-auth-file
+++ b/generate-ci-auth-file
@@ -1,6 +1,11 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+if [[ -z "${REFRESH_TOKEN}" ]]; then
+  echo "REFRESH_TOKEN is not set. If this is running in CI, it's because secrets are not passed to forks."
+  exit 2;
+fi
+
 curl https://api.dropbox.com/oauth2/token \
     -d grant_type=refresh_token \
     -d refresh_token=$REFRESH_TOKEN \