Skip to main content
DevOps Insightsguides & answers

GitHub · troubleshooting

remote: Support for password authentication was removed

GitHub stopped accepting account passwords for Git over HTTPS on 13 August 2021, so use a personal access token, gh auth login or SSH instead. If Git does not even ask, a saved old password is being sent: remove it with git credential reject.

First published

New to this? Read what is actually happening first, then come back to the steps.

On this page · 10 sections

Before you start

  • A GitHub account and permission to create a personal access token, or the GitHub CLI (gh).
  • Access to your Git credential helper (macOS Keychain, Windows Credential Manager, libsecret or a store file).

Run this first

step 1 of 2
git remote -v

Look for https://github.com/… or git@github.com:…

Shows whether the remote uses HTTPS (needs a token) or SSH (needs a key).

Work out which cause you have

A few questions to narrow the list. Every answer ends in a command that confirms or rules the cause out — this cannot see your cluster, so nothing here is a certainty until you have checked.

Narrow it down

0 answered · nothing is sent anywhere

Does Git ask you for a password before failing?

Cause space

3 of 3 still possible

  • Your account password was given at Git's password promptCommon
  • A credential helper keeps sending an old passwordCommon
  • A script or CI job authenticates with a username and passwordOccasional

Nothing ruled out yet. Answer the question above and the branches your answer eliminates will strike through here.

Check it with a tool

Or diagnose it manually

In this order. The first command usually contains the whole answer.

  1. Step 1

    git remote -v

    Shows whether the remote uses HTTPS (needs a token) or SSH (needs a key).

    Look for https://github.com/… or git@github.com:…

  2. Step 2

    GIT_TRACE=1 git push 2>&1 | grep -i 'credential' | head

    Shows which credential helper Git calls, so you know where the old password lives.

    Look for git-credential-osxkeychain, manager, store or libsecret

Every cause, and how to fix it

Ordered by how often each one turns out to be the answer.

Your account password was given at Git's password prompt

Common

Git asked for a username and password for an https:// remote and received the GitHub account password, which GitHub no longer accepts for Git.

Confirm

git remote -v

An https://github.com/… remote

Fix

  • Sign in once with the GitHub CLI, which also sets up Git to use it: gh auth login, then choose HTTPS.
  • Or create a fine-grained personal access token for the repositories you need and paste it when Git asks for the password.
  • Or install Git Credential Manager and let it sign you in through the browser.
gh auth login

Choose GitHub.com and HTTPS, and let it configure Git; then push again.

A credential helper keeps sending an old password

Common

Your password was saved before the change (in the macOS Keychain, Windows Credential Manager or a store file). Git sends it automatically, it fails, and Git never asks for anything new.

Confirm

git config --show-origin --get-all credential.helper

A helper is configured, and the push fails without prompting

Fix

  • Remove the saved entry so Git prompts again: printf 'protocol=https\nhost=github.com\n\n' | git credential reject.
  • Then authenticate with a token, gh auth login or Git Credential Manager; the helper will save the new credential.
printf 'protocol=https\nhost=github.com\n\n' | git credential reject

Erases the saved GitHub credential from whichever helper you use. Checked on Git 2.50.1.

A script or CI job authenticates with a username and password

Occasional

An old script, a CI variable or a tool still builds https://USER:PASSWORD@github.com/… or passes the account password.

Confirm

grep -rn 'github.com' .git/config .github/ scripts/ 2>/dev/null | grep -i '@github.com'

Credentials embedded in a remote URL, or a password variable used for Git

Fix

  • In GitHub Actions, use actions/checkout, which authenticates with the job's GITHUB_TOKEN; elsewhere use a token with the least access, from the CI system's secret store.
  • For read-only access to one repository, use a deploy key over SSH instead of any account credential.

Understanding it properly

Skip this if you are mid-incident — the working part of the page is above. Worth reading afterwards, because understanding the mechanism is what stops the next one.

In plain terms

When you push to GitHub over an https:// address, Git asks for a username and password. Your GitHub account password no longer works there; GitHub wants a token, a long generated string that you can limit to certain repositories and revoke. Old saved passwords on your machine keep being sent and keep failing, which is why the error can appear without Git even asking.

Words used on this page

Personal access token
A generated credential used in place of a password for Git over HTTPS and for the API. Fine-grained tokens can be limited to chosen repositories and permissions.
Credential helper
The program Git asks for saved usernames and passwords (osxkeychain, manager, store, libsecret). It may still hold your old password.
Git Credential Manager
A credential helper that signs you in through the browser and handles tokens and 2FA for you.
What is actually happening

GitHub announced in December 2020 that, beginning 13 August 2021, it would no longer accept account passwords when authenticating Git operations on GitHub.com. Accounts with two-factor authentication already needed a token or SSH; GitHub Enterprise Server was not part of the change.

The server answers with remote: Support for password authentication was removed on August 13, 2021, a link to GitHub's documentation, and then Git's own fatal: Authentication failed for 'https://github.com/OWNER/REPO.git/'.

GitHub's documentation says to enter a personal access token when Git prompts for a password, or to let a credential helper such as the GitHub CLI or Git Credential Manager handle sign-in.

If Git does not prompt at all, a credential helper is sending an old saved password. Remove that entry (git credential reject) so Git asks again.

How to tell this is your problem
WhereWhat you see
git push, pull or clone over HTTPSremote: Support for password authentication was removed on August 13, 2021. remote: Please see https://docs.github.com/… for information on currently recommended modes of authentication. fatal: Authentication failed for 'https://github.com/OWNER/REPO.git/'
TimingFails immediately without asking for a password, because a saved password is sent

How to know it is actually fixed

  • git push succeeds.
  • A second push does not ask again (the helper saved the new credential).

Stopping it happening again

  • Use gh auth login or Git Credential Manager on every machine, so tokens are created and rotated for you.
  • Prefer SSH keys or deploy keys for automation that needs Git access, and the platform's own token in CI.
  • Give tokens an expiry, and keep a reminder to replace them before it.

Security considerations

  • Treat a personal access token like a password: give it the least access and the shortest expiry that works, and never put it in a remote URL that ends up in shell history, logs or a committed .git/config.
  • In CI, do not use a personal token at all where the platform has its own: GITHUB_TOKEN in GitHub Actions, or a deploy key for read-only access.

Sources

Behaviour described here is drawn from official documentation. Where a figure could not be confirmed on an official page it is attributed in the text rather than stated as canonical.

Did this get you to an answer?

No text box on purpose — please do not paste production logs anywhere

Something wrong or out of date? Report it

Where to go next