Authentication: HTTPS and SSH
Reading a public repository needs no login, but pushing — and anything involving a private repository — requires proving who you are. GitHub and similar hosts don't accept your account password for Git commands; you sign in through a credential helper, a personal access token, or an SSH key.
Option 1: HTTPS with a credential helper
This is the easiest route for most people. The first time you push to an https:// URL, a helper program opens a browser window (or asks for a token), and then stores the credential securely so you aren't asked again.
- Windows — Git for Windows includes Git Credential Manager. Nothing to set up: a sign-in window appears on the first push.
- macOS — Apple's Git saves credentials in the Keychain (
credential.helper osxkeychain). Git Credential Manager can also be installed for the browser sign-in flow. - Linux — install Git Credential Manager, or use GitHub's CLI as below.
Check which helper is configured:
git config --get credential.helper
The GitHub CLI
GitHub's official command-line tool, gh, can set up authentication for you — and later create repositories and pull requests from the terminal:
gh auth login
It asks a few questions (GitHub.com, HTTPS or SSH, sign in with a browser) and configures Git to use it as the credential helper.
Personal access tokens
A personal access token (PAT) is a long random string you create on GitHub (Settings → Developer settings → Personal access tokens) and paste in place of a password when Git asks. Prefer fine-grained tokens limited to the repositories and permissions you need, and give them an expiry date. Tokens are mainly useful for scripts and servers where a browser sign-in isn't possible. Treat a token exactly like a password: never commit it, and revoke it immediately if it leaks.
Option 2: SSH keys
SSH uses a pair of keys: a private key that never leaves your computer and a public key you give to GitHub. Once set up, pushes and pulls just work, with no tokens to renew.
1. Create a key
ssh-keygen -t ed25519 -C "sam@example.com"
Press Enter to accept the default location (~/.ssh/id_ed25519), and choose a passphrase to protect the key. This creates two files: id_ed25519 (private — keep it secret) and id_ed25519.pub (public).
2. Load it into the SSH agent
The agent remembers your passphrase so you don't type it on every push:
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
On macOS, add --apple-use-keychain to ssh-add to store the passphrase in the Keychain.
3. Give GitHub the public key
cat ~/.ssh/id_ed25519.pub
Copy the whole line it prints (starting ssh-ed25519). On GitHub, open Settings → SSH and GPG keys → New SSH key, paste it and save.
4. Test the connection
ssh -T git@github.com
The first time, SSH asks you to confirm GitHub's host fingerprint (compare it with the fingerprints GitHub publishes in its documentation) and then greets you by username, saying you've authenticated successfully but that GitHub doesn't provide shell access. That's the expected result.
5. Use SSH URLs
Clone with the SSH form, or switch an existing repository's remote:
git clone git@github.com:sam-rivera/recipes.git git remote set-url origin git@github.com:sam-rivera/recipes.git
Which should I choose?
| HTTPS + credential helper | SSH | |
|---|---|---|
| Setup | Almost none | A few one-time steps |
| Works through strict firewalls | Yes (port 443) | Usually (port 22; GitHub also offers SSH over 443) |
| Day to day | Seamless once signed in | Seamless once the key is loaded |
| Revoking access | Sign out / revoke the token | Delete the key on GitHub |
Either is fine. Many people use HTTPS with a credential helper on personal machines and SSH on servers and long-lived development setups.
Common errors
| Message | Usual cause |
|---|---|
Authentication failed / Support for password authentication was removed | You typed your account password. Use the browser sign-in or a token. |
Permission denied (publickey) | SSH: the key isn't loaded (ssh-add) or not added to your GitHub account. |
Repository not found | A typo in the URL — or the repository is private and you're signed in as an account without access. |
Permission to … denied to … | You're authenticated, but as a user who can't push to that repository. Ask for access or use a fork. |
Two-factor authentication
GitHub requires two-factor authentication (2FA) for accounts that contribute code. It doesn't change the Git commands: the browser sign-in handles the second factor, and tokens and SSH keys count as already verified.
Signing in elsewhere
GitLab, Bitbucket, Azure DevOps and Codeberg follow the same patterns: a credential manager or access token for HTTPS, and SSH keys added in your profile settings. Git Credential Manager supports several of them.
Try it yourself
Set up one method — gh auth login or an SSH key — and push a commit to a repository you own. If you chose SSH, check git remote -v shows a git@github.com: URL.