GitHub token and Git authentication: personal access token, Git Credential Manager, push without a password

Why Git no longer accepts your GitHub password

If you enter your github.com login and password during git push and get rejected, the reason is not a typo. Since 13 August 2021, GitHub has disabled password sign-in for Git operations over HTTPS. Instead of a password, you need a GitHub token (personal access token, PAT) or browser-based sign-in performed by Git Credential Manager.

The error message looks like this:

remote: Support for password authentication was removed on August 13, 2021.
remote: Please see https://docs.github.com/... for information on currently recommended modes of authentication.
fatal: Authentication failed for 'https://github.com/user/project.git/'

The reason is simple. An account password gives full access to everything. It cannot be limited to one repository, and it is inconvenient to revoke. A token is created for a specific task, has an expiry date and a set of permissions, and if it leaks, you delete it in a minute without changing your password. GitLab and Bitbucket have moved the same way, so what is described below applies in principle to them too.

Two ways to authenticate: HTTPS and SSH

Git talks to a remote repository over one of two protocols, and this determines how you sign in.

You set up an SSH key once, and after that Git does not ask for a login or password at all. Its creation and adding to GitHub are covered in the article on configuring Git. Here we focus on HTTPS, because that is where beginners most often see a password prompt. To check which protocol your repository uses, run:

git remote -v
origin  https://github.com/user/project.git (fetch)
origin  https://github.com/user/project.git (push)

How to create a GitHub token (personal access token)

A personal access token is a long random string that GitHub issues to you instead of a password for programmatic access. Classic tokens start with ghp_, fine-grained tokens start with github_pat_. The token is shown only once, right after creation, so copy it into a password manager.

Step by step

1. Sign in to github.com, click your avatar in the top right corner, and open Settings.
2. At the bottom of the left menu, choose Developer settings, then Personal access tokens.
3. Choose a type: Fine-grained tokens (recommended) or Tokens (classic), and click the button to create a new token.
4. Give it a clear name (for example, "laptop, work"), an expiration date and permissions.
5. Click Generate and copy the token immediately.

Fine-grained or classic

A fine-grained token is limited to specific repositories and individual permissions. For everyday code work, select the repositories you need and grant Contents: Read and write for them. That is enough for clone, pull and push. If you only read a private repository, Read-only is enough.

A classic token applies to all of your repositories at once. Pushing to a repository requires the repo scope, and changing files in .github/workflows additionally requires workflow. Classic tokens are simpler but riskier: a leak opens access to the whole account.

Expiration

GitHub offers several expiration periods and lets you set your own date. You can create a token without an expiry, but it is better not to: a forgotten token that never expires is a classic security hole. A sensible choice is 30 to 90 days, with renewal when GitHub sends a reminder e-mail before the token expires.

Git push and git clone with a token

Using a token is simpler than it sounds. Git asks for a "Password," and you paste the token there instead of a password.

$ git push origin main
Username for 'https://github.com': your-login
Password for 'https://your-login@github.com': <paste the token>

The terminal does not show the characters of the password. This is normal: paste the token and press Enter. In Git Bash on Windows, pasting works with Shift+Insert or the right mouse button.

Git clone with a token

A private repository is cloned the same way: git clone asks for your login and the token. If you need to avoid prompts (for example, in a script), you can put the token straight into the address:

git clone https://your-login:<TOKEN>@github.com/user/project.git

Keep in mind the downside: the address with the token is saved in .git/config and may end up in your shell history. After cloning, it is better to remove the token from the address:

git remote set-url origin https://github.com/user/project.git

In CI systems, tokens are passed as secret environment variables rather than written to files. GitHub Actions already provides a built-in GITHUB_TOKEN for the current repository, so a separate PAT is often not needed there.

GitLab: git clone with a token

In GitLab, a token is created in your profile settings in the Access tokens section. For working with code you need the read_repository and write_repository scopes. The scheme is the same: your GitLab login as the user name and the token as the password.

git clone https://oauth2:<TOKEN>@gitlab.com/group/project.git

GitLab accepts the name oauth2 for any personal token. You can also use your own login instead.

Git pull and fetch

For a public repository, git pull and git clone work without authentication. You are asked for a login and a token only for a private repository or during git push. If pull on a public project suddenly asks for a password, most often the address has a typo. GitHub answers a non-existent repository the same way as a private one.

Git Credential Manager: what it is

Typing a token on every push is inconvenient. This job is handled by a credential helper, a helper program that Git calls when it needs credentials. Git passes it the server address, and the helper returns the login and password (or token) from its storage.

Git Credential Manager (GCM) is the most convenient of these helpers. It is a cross-platform program from GitHub and Microsoft. On the first push, it opens a sign-in window or your browser, you sign in to GitHub (including with two-factor authentication), and GCM receives the token itself and keeps it in the protected storage of your system. In this case you do not need to create a PAT by hand.

GCM supports GitHub, GitLab, Bitbucket and Azure DevOps. Git for Windows installs it by default. It is the credential helper option you see in the installer.

Types of credential.helper

Setting up Git authentication on Windows, macOS and Linux

To see which helper is already configured, run:

git config --show-origin --get-all credential.helper

Windows

If you kept the default settings during Git installation, GCM already works. On the first push from Git Bash, PowerShell or VS Code, a GitHub sign-in window opens. If no helper is configured, enable it manually:

git config --global credential.helper manager

macOS

On a Mac, Git usually uses osxkeychain already: a token you enter once goes into the Keychain. To get browser sign-in, install Git Credential Manager, for example with Homebrew: brew install --cask git-credential-manager. It configures itself in the Git settings.

Linux

On Linux, GCM is installed separately (a .deb package or an archive from the project's releases). Then run the configuration and choose a storage:

git-credential-manager configure
git config --global credential.credentialStore secretservice

On a server without a graphical environment, a temporary cache is simpler:

git config --global credential.helper 'cache --timeout=3600'

An alternative for GitHub: gh auth login

If you have the GitHub CLI installed, the command gh auth login walks you through browser sign-in, and gh auth setup-git configures Git to take credentials from gh. It is a convenient way to "log in to Git Bash" in one command.

How to reset or update saved Git credentials

The most common situation: your token has expired or you changed accounts, but Git keeps supplying the old data and gets Authentication failed. You need to delete the saved entry. Then Git asks again on the next push.

Universal command

This works with any helper:

printf "protocol=https\nhost=github.com\n\n" | git credential reject

Git reset credentials on Windows

Open Control Panel → Credential Manager → Windows Credentials, find entries like git:https://github.com, and delete them. You can do the same from the command line:

cmdkey /list | findstr git
cmdkey /delete:git:https://github.com

If you use GCM, it has its own command to sign out of an account: git credential-manager github logout <login>.

macOS

Open Keychain Access, find the github.com entry of the "Internet password" type, and delete it. Or do it from the terminal:

git credential-osxkeychain erase
host=github.com
protocol=https

After the last line, press Enter once more to send the empty line.

Linux and store

For store, delete the line with github.com from ~/.git-credentials. For cache, run git credential-cache exit.

Authentication errors and how to fix them

Support for password authentication was removed

You entered your account password. Create a token and paste it into the Password field, or set up Git Credential Manager. If the error repeats without a password prompt, the old password is stored in the credential storage. Delete it as described above.

git push: Authentication failed

Causes in order of frequency: the token has expired; the token was revoked; a fine-grained token has no access to this repository, or its Contents permission is read-only; the storage holds the data of another account. Check the expiry date and permissions of the token in Developer settings, then reset the saved credentials.

remote: Permission denied (403)

Authentication succeeded, but your account has no write access to this repository. The owner must add you as a collaborator, or you can work through your own fork and a pull request.

Repository not found

For a private repository, GitHub does not reveal whether it exists, so with a wrong token it reports "not found." Check the address with git remote -v and the permissions of your token.

Git clone asks for a password every time

No credential helper is configured. Enable manager or osxkeychain. After the first successful entry, Git stops asking. Another option is to switch to SSH.

How to store a token safely

• Grant the minimum permissions: a fine-grained token for the repositories you need instead of a classic token with repo.
• Set an expiry date and create a new token when needed, rather than extending the old one forever.
• Do not commit tokens or put them in remote addresses. If a token gets into a public repository, GitHub may revoke it automatically, but treat it as compromised and delete it yourself.
• Use the system storage (GCM, Keychain) instead of store.
• One token for one machine or task: if it leaks, you revoke only that one.

Summary

A GitHub password has not worked for Git over HTTPS since 2021. There are three working options: sign in through Git Credential Manager in the browser, create a GitHub token and enter it instead of a password, or switch to SSH keys. Create a token in Settings → Developer settings, let the credential.helper store it, and when you see Authentication failed, renewing the token and resetting the old credentials almost always helps. Connecting to GitHub and working with remote repositories is covered hands-on in our Git course.