The first time you run git push to a GitHub repository, GitHub needs to know it's really you. Typing your account password won't work: GitHub stopped accepting passwords for Git operations in 2021, because passwords are too easy to steal and reuse. Many beginners see "Authentication failed" at exactly this moment and get stuck.
There are two safe ways to connect instead. With HTTPS, you use a personal access token or let a credential helper sign you in through the browser. With SSH, you create a pair of keys on your computer and give GitHub the public half; from then on, your computer proves who you are automatically.
In this lesson you'll understand how both work, set up an SSH key step by step, connect an existing repository to it, and protect your account with two-factor authentication. You only need to do this once per computer.
HTTPS or SSH?
Every repository has two addresses, shown under the green Code button:
| HTTPS | SSH | |
|---|---|---|
| Address | https://github.com/samlee/portfolio.git | git@github.com:samlee/portfolio.git |
| You prove identity with | A token or browser sign-in | A key pair stored on your computer |
| Setup | Usually automatic with a credential manager | A few commands, once per computer |
| Works through strict firewalls | Almost always | Sometimes blocked |
Both are equally good. HTTPS is easiest to start with; SSH is popular with developers because, once set up, it never asks for anything.
HTTPS with a credential manager or token
Git for Windows includes Git Credential Manager. The first time you push, it opens a browser window, you sign in to GitHub, and it stores the credential securely, so you're never asked again. On macOS, the Keychain does the same job.
If no browser sign-in appears, create a personal access token (PAT): open Settings, Developer settings, Personal access tokens, and generate a fine-grained token limited to the repositories it needs, with an expiry date. Paste the token when Git asks for a password. Treat it exactly like a password: never commit it or share it.
Creating an SSH key
An SSH key is a pair of files: a private key that never leaves your computer and a public key you can safely give to GitHub. Create one with:
ssh-keygen -t ed25519 -C "sam@example.com"- Press Enter to accept the default location,
~/.ssh/id_ed25519. - Choose a passphrase. It protects the key if someone copies your files; an SSH agent can remember it so you don't type it constantly.
- Two files are created:
id_ed25519(private) andid_ed25519.pub(public).
Then copy the public key and add it to GitHub under Settings, SSH and GPG keys, New SSH key.
Testing and switching remotes
Check the connection with:
ssh -T git@github.comGitHub replies with a greeting containing your username. If a repository was cloned with HTTPS, point it at the SSH address instead:
git remote set-url origin git@github.com:samlee/portfolio.gitNew clones can simply use the SSH address from the Code button.
GitHub Authentication Syntax
Authentication commands
ssh-keygen -t ed25519 -C "you@example.com"
cat ~/.ssh/id_ed25519.pub # show the public key to copy
ssh -T git@github.com # test the connection
git remote -v # see which address is used
git remote set-url origin git@github.com:<user>/<repo>.gitGitHub Authentication Summary
- GitHub doesn't accept account passwords for git push; use a token, a credential manager or SSH.
- HTTPS addresses start with https://; SSH addresses look like git@github.com:user/repo.git.
ssh-keygen -t ed25519creates a private key and a public key.- Only the public key (.pub) is added to GitHub; the private key never leaves your computer.
- Test with
ssh -T git@github.com, and switch a repository withgit remote set-url.
GitHub Authentication Examples
Each example shows the code, the output it produces and what each part does.
Creating a key
ssh-keygen -t ed25519 -C "sam@example.com"Generating public/private ed25519 key pair.
Enter file in which to save the key (/c/Users/sam/.ssh/id_ed25519):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /c/Users/sam/.ssh/id_ed25519
Your public key has been saved in /c/Users/sam/.ssh/id_ed25519.pub
The key fingerprint is:
SHA256:Qm4b2YyP1xT8kZr6Hc0aN3vJdWf5LsE7uGiOpR9tBnM sam@example.comLine-by-line explanation
- Line 1ed25519 is a modern, short and secure key type, and the -C comment is a label that helps you recognise the key later. In the output, press Enter to accept the default location, then type a passphrase twice (it isn't shown as you type). The last lines name the two files created: the private key and the .pub public key.
Copying the public key and testing
cat ~/.ssh/id_ed25519.pub
ssh -T git@github.comssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK7r3qF2b9x0Yv1n sam@example.com
The authenticity of host 'github.com' can't be established.
ED25519 key fingerprint is SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU.
Are you sure you want to continue connecting (yes/no)? yes
Hi samlee! You've successfully authenticated, but GitHub does not provide shell access.Line-by-line explanation
- Line 1Print the public key, then copy the whole line into GitHub's New SSH key form.
- Line 2The first connection asks you to confirm GitHub's fingerprint. Check it matches the one in GitHub's documentation, then type yes. The final greeting confirms the key works, and the "no shell access" part is normal.
Switching an existing repository to SSH
git remote -v
git remote set-url origin git@github.com:samlee/portfolio.git
git remote -v
git pushorigin https://github.com/samlee/portfolio.git (fetch)
origin https://github.com/samlee/portfolio.git (push)
origin git@github.com:samlee/portfolio.git (fetch)
origin git@github.com:samlee/portfolio.git (push)
Everything up-to-dateLine-by-line explanation
- Line 1The repository currently uses HTTPS.
- Line 2Replace the address with the SSH one.
- Line 4Pushing now uses your key, with no prompt.
Common GitHub Authentication Mistakes
Typing your account password
git push
Username: samlee
Password: my-github-password
remote: Support for password authentication was removed.# sign in through Git Credential Manager, paste a token, or use SSH
git remote set-url origin git@github.com:samlee/portfolio.gitSharing the private key
cat ~/.ssh/id_ed25519 # pasting this into GitHub or a chatcat ~/.ssh/id_ed25519.pub # only the .pub file is sharedAnyone with your private key can act as you. If it leaks, delete the key on GitHub and create a new one.
Committing a token
const token = "github_pat_11ABCDEF..."; // pushed to a public repository# keep secrets in environment variables or a .env file listed in .gitignoreGitHub scans for leaked tokens and revokes many automatically, but treat any exposed token as compromised and delete it.
GitHub Authentication in Real Projects
Authentication at work
Most developers set up SSH once on each work laptop and forget about it. Companies often require 2FA, security keys and SSH keys tied to company accounts, and automated systems such as deployment servers use their own limited deploy keys or tokens with only the permissions they need, rather than a person's account.
GitHub Authentication FAQ
What does "Permission denied (publickey)" mean?
GitHub didn't accept any SSH key your computer offered. Usually the key isn't added to your GitHub account, isn't loaded into ssh-agent, or the file isn't where SSH looks. Run ssh -T git@github.com to test, and ssh -vT git@github.com to see which keys are tried.
What is ssh-agent and why do I need it?
ssh-agent is a small background program that holds your unlocked private key in memory. You type the key's passphrase once with ssh-add ~/.ssh/id_ed25519, and later pushes and pulls don't ask again. On macOS and many Linux desktops it starts automatically.
Can I use the same SSH key on several computers?
You can, but it's better to create a separate key on each computer and add each one to GitHub. Then if a laptop is lost or stolen, you delete just that key from your account and the others keep working. Give each key a title that says which computer it belongs to.
How do I use SSH with GitHub when port 22 is blocked?
GitHub also accepts SSH on port 443 through the host ssh.github.com. Test it with ssh -T -p 443 git@ssh.github.com. If that works, add a Host github.com entry to ~/.ssh/config with Hostname ssh.github.com and Port 443, and your normal remote URLs keep working.
What is the difference between fine-grained and classic personal access tokens?
A fine-grained token is limited to the repositories you choose and to specific permissions, such as read-only access to contents. A classic token uses broader scopes that apply to every repository you can reach. Prefer fine-grained tokens with an expiry date, so a leaked token can do less damage.
GitHub Authentication Exercises
Answer each one and check it instantly. If you get stuck, open the hint before the answer.
Complete the command that creates a new SSH key.
-t ed25519 -C "sam@example.com"Which file do you add to GitHub?
Which address is an SSH remote?
You run ssh -T git@github.com and see "Hi ada! You've successfully authenticated". What does it mean?
You cloned with HTTPS but want to use SSH from now on. What's the best command?
GitHub Authentication Quiz
5 questions to check what you learned.
Why does
git pushreject your GitHub account password?- The password is too short
- GitHub no longer accepts account passwords for Git operations
- Git doesn't support passwords at all
- Only private repositories need passwords
What is a personal access token?
- An SSH key
- A type of commit
- A GitHub badge
- A generated secret used instead of a password, with limited permissions and an expiry
What does an SSH key passphrase protect against?
- Someone using your private key if they copy the file
- Slow pushes
- Merge conflicts
- Losing commits
What does two-factor authentication add?
- A second GitHub account
- A second proof of identity, such as an app code or security key, in addition to the password
- A backup of your repositories
- Faster sign-in
Your private key may have leaked. What should you do first?
- Rename the file
- Change your profile picture
- Delete that key in GitHub's SSH settings and create a new key pair
- Nothing, keys can't be misused