Your password works when you sign in to github.com, and Git rejects it: ```text remote: Support for password authentication was removed on August 13, 2021. remote: Please see https://docs.github.com/get-started/getting-started-with-git/about-remote-repositories#cloning-with-https-urls for information on currently recommended modes of authentication. fatal: Authentication failed for 'https://github.com/you/your-repo.git/' ``` GitHub has since shortened the message. Running the same thing today gives this instead, tested with Git 2.55.0: ```text remote: Invalid username or token. Password authentication is not supported for Git operations. fatal: Authentication failed for 'https://github.com/you/your-repo.git/' ``` Both mean one thing: the account password is not a Git credential and has not been since 13 August 2021. You need either an SSH key or a personal access token. Nothing is wrong with your account. ## Check Which Remote You Are Using The error only happens over HTTPS, so confirm that is what you have: ```bash git remote -v ``` ```text origin https://github.com/you/your-repo.git (fetch) origin https://github.com/you/your-repo.git (push) ``` A URL starting `https://` uses password or token auth. One starting `git@github.com:` uses SSH and never asks for a password. That difference is the whole decision below. ## Which Fix to Pick **Switch to SSH** Best if this is your own machine and you push regularly. Set it up once and nothing expires. --card-- **Use a personal access token** Best on a machine where you cannot add an SSH key, behind a proxy that blocks port 22, or in CI. You do not need both. ## Fix 1: Switch the Remote to SSH Point the existing remote at the SSH URL. The path after the colon is the same `owner/repo` you already have: ```bash git remote set-url origin git@github.com:you/your-repo.git git remote -v ``` ```text origin git@github.com:you/your-repo.git (fetch) origin git@github.com:you/your-repo.git (push) ``` Then confirm the key half works before pushing: ```bash ssh -T git@github.com ``` ```text Hi you! You've successfully authenticated, but GitHub does not provide shell access. ``` That message is success. If you get `Permission denied (publickey)` instead, the remote is fine and the key is not, so work through [Fix Permission Denied (publickey)][publickey] and come back. Nothing else changes. `git push` uses the new URL from here on. ## Fix 2: Create a Personal Access Token A token is a password replacement that you can scope and revoke. 1. Open [Personal access tokens][pat-settings] in GitHub settings. 2. Choose **Fine-grained tokens** and **Generate new token**. 3. Pick the repositories it may touch, rather than granting everything. 4. Under **Repository permissions**, set **Contents** to **Read and write**. That is the permission `git push` needs. 5. Set an expiry you will actually notice, then generate and copy it. Copy it now. GitHub shows the value once. Use it where Git asks for a password: ```bash git push ``` ```text Username for 'https://github.com': you Password for 'https://you@github.com': ``` The classic token type still works and is simpler to create, but it grants the selected scopes across every repository you can reach. Prefer fine-grained tokens for anything beyond a throwaway. ## Stop It Asking Every Time Entering a token on each push gets old. Store it in the operating system keychain rather than on disk. On macOS, Git ships with a keychain helper: ```bash git config --global credential.helper osxkeychain ``` On Windows, Git for Windows ships with the cross-platform manager: ```bash git config --global credential.helper manager ``` On Linux, install [Git Credential Manager][gcm] and enable it: ```bash git config --global credential.helper manager ``` The next push prompts once and the token is stored. Avoid `credential.helper store`, which writes the token to `~/.git-credentials` in plain text. ## Verify A public repository clones without credentials, so it proves nothing here. Test against a repository that requires auth: ```bash git ls-remote https://github.com/you/your-private-repo.git HEAD ``` A commit hash means the credential works. Another `Invalid username or token` means the token lacks Contents access to that repository, or you pasted the username where the token belongs. ## Common Mistakes * **Pasting the token as the username.** The username stays your GitHub login. The token goes in the password field. * **Reusing a fine-grained token on a repository it was not scoped to.** It fails exactly like a bad password. * **An expired token.** Fine-grained tokens expire by default, and the failure looks identical to a wrong one. Check the date before debugging anything else. * **Assuming SSH fixes an HTTPS clone you already made.** `git remote set-url` is required; changing your keys alone does nothing. * **Embedding the token in the remote URL.** It ends up in `.git/config` in plain text and in any shell history that touched it. ## Related Content * [Fix Permission Denied (publickey)][publickey] is the next stop if you switch to SSH and the key is not working yet. * [Fix: ssh: connect to host github.com port 22][port22] covers the case where SSH is blocked and a token is the practical answer. * [Fix GitHub Push Declined Email Privacy Error][push-declined] covers the error that stops the push right after this one is solved. * [How to Use Multiple GitHub Accounts][multiple-accounts] covers credentials when more than one account is in play. ## References * [About remote repositories][github-remotes], GitHub's page on HTTPS versus SSH URLs. * [Managing your personal access tokens][github-pat], for fine-grained versus classic tokens. * [Token authentication requirements for Git operations][github-token-announcement], the original deprecation notice. * [Git Credential Manager][gcm], for storing credentials in the OS keychain. * [gitcredentials(7)][git-credentials-docs], for how Git chooses a helper. [publickey]: https://jeffbailey.us/blog/2019/11/10/setting-ssh-key-permissions/ [port22]: https://jeffbailey.us/blog/2026/09/21/ssh-connect-to-host-github-port-22/ [push-declined]: https://jeffbailey.us/blog/2020/01/20/push-declined-due-to-email-privacy-restrictions-on-github/ [multiple-accounts]: https://jeffbailey.us/how-do-i-use-multiple-github-accounts/ [pat-settings]: https://github.com/settings/personal-access-tokens [github-remotes]: https://docs.github.com/en/get-started/git-basics/about-remote-repositories [github-pat]: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens [github-token-announcement]: https://github.blog/security/application-security/token-authentication-requirements-for-git-operations/ [gcm]: https://github.com/git-ecosystem/git-credential-manager [git-credentials-docs]: https://git-scm.com/docs/gitcredentials