fatal: Authentication failed for (Git HTTPS)
Git reached the host over HTTPS but the username/password (or token) it sent was rejected. The remote is fine; your credentials are not.
What this error means
Git connected to the HTTPS endpoint and sent an Authorization header (or basic auth). The server answered 401. Classic message:
remote: Invalid username or token. Password authentication is not supported for Git operations.
fatal: Authentication failed for 'https://github.com/org/repo.git/'Same family on GitLab/Bitbucket: HTTP Basic: Access denied, Authentication failed, Access denied.
Checklist (most common first)
- Password no longer works for Git — GitHub removed password Git auth in 2021. Create a fine-grained or classic Personal Access Token (PAT) with
repo(or contents) scope, then use the token as the password when Git asks. Username is still your account name (or anything non-empty on some hosts). - Stale credential in the helper — macOS Keychain, Windows Credential Manager, or
git-credential-storemay still hold an old password. Clear the entry forgithub.com/gitlab.comand push again so Git prompts fresh.# see what helper you use git config --show-origin --get-regexp credential # macOS example: open Keychain Access → search github.com → delete internet password # Windows: Control Panel → Credential Manager → Windows Credentials → git:https://… # Linux store file: # ~/.git-credentials - Expired or revoked token — PATs expire; org SSO may need “Authorize” next to the token. Regenerate and update the helper.
- Wrong remote URL — cloning someone else’s fork, a renamed org, or
https://github.com/org/repowithout.gitis fine, but a typo’d org/user yields auth failure or 404 depending on visibility. Check with:git remote -v # switch HTTPS ↔ SSH if you prefer keys: git remote set-url origin [email protected]:org/repo.git - 2FA / SSO org — org requires SAML SSO; authorize the PAT or SSH key for that organization.
- CI / deploy keys — machine users need a token or deploy key with write scope; a read-only token cannot push.
PAT vs SSH
| Method | When to use |
|---|---|
| HTTPS + PAT | Laptops, CI secrets, firewalls that block outbound 22 |
| SSH key | Daily driver once ssh -T git@host works; see publickey guide |
Not the same as
- Permission denied (publickey) — SSH path; no HTTPS credentials involved.
- git push rejected (non-fast-forward) — auth succeeded; history diverged.
- SSH connection timed out — never reached the host on port 22.
Related
Permission denied (publickey) · SSH key permissions too open · git push rejected · .env files and secrets · Host key verification failed
Questions
What does fatal: Authentication failed for mean?
The HTTPS Git remote rejected your username/password or token. Fix or replace the credentials; the network path itself worked.
Why did my GitHub password stop working?
GitHub no longer accepts account passwords for Git over HTTPS. Use a Personal Access Token as the password, or switch the remote to SSH.
How do I clear a cached wrong password?
Remove the github.com / gitlab.com entry from your OS credential helper (Keychain, Credential Manager, or ~/.git-credentials), then push again.
Can I use SSH instead?
Yes. git remote set-url origin [email protected]:org/repo.git and ensure your SSH key is loaded. See Permission denied (publickey) if that fails.
Does this mean the repo was deleted?
Usually not. A missing private repo can also 401, but first assume bad/expired credentials. Check the URL in a browser while logged in.
CI keeps failing with Authentication failed
The job’s PAT or deploy key is missing, expired, or lacks push scope. Store a fresh token in the CI secret store and map it to the credential helper or remote URL.
Published .