Troubleshoot Git push authentication failures

Start by checking the push URL and the authentication method it uses. For GitHub HTTPS access, an account password is not accepted for Git operations; use a supported token or a credential manager's authentication flow. For SSH, check the key and the account associated with it.

An authentication error is different from a network connection failure or a rejected branch update. Read the complete error before changing credentials.

1. Check the remote and protocol

git remote -v

For https://github.com/..., a manually entered password must be a personal access token. For git@github.com:..., test SSH:

ssh -T git@github.com

If your remote is GitLab or another host, follow that service's authentication policy rather than assuming every GitHub setting applies.

2. Create or replace an HTTPS credential

On GitHub, personal access tokens are managed under Settings → Developer settings → Personal access tokens. Choose the intended resource owner and repositories, and grant the minimum permissions needed. A fine-grained token used for pushing typically needs repository contents write access; changes to workflows can require additional permission. Classic tokens use different scopes, and organizations can impose approval or access restrictions.

When prompted, enter your GitHub username and use the token in the password field. Do not place the token in the remote URL or paste it into diagnostic logs. Git Credential Manager can also authenticate through a browser without asking you to manage a token manually.

3. Remove a stale cached credential

Identify the active helper:

git config --show-origin --get-all credential.helper

Use Keychain Access on macOS or the configured credential manager on Windows to remove the matching expired entry. A helper-independent way to request removal is:

printf 'protocol=https\nhost=github.com\nusername=YOUR_USERNAME\n\n' | git credential reject

Replace YOUR_USERNAME with the affected account. Helper matching rules vary; repositories using credential.useHttpPath may also need the repository path. Avoid clearing every account's credentials when only one is wrong.

4. Check repository and organization access

Successful authentication does not grant write access automatically. Confirm that the account has permission to push to the repository and that the token covers it. For SAML SSO organizations, classic tokens and SSH keys may require explicit organization authorization; fine-grained tokens use their resource-owner and approval flow.

Branch protection and repository rules can reject an otherwise authenticated push. Fix the access or workflow requirement rather than repeatedly issuing new tokens.

FAQ

Does enabling two-factor authentication change this?

GitHub account passwords are unsupported for HTTPS Git operations regardless of whether 2FA is enabled. Tokens, credential-manager flows, and SSH keys are supported alternatives.

What does Permission denied (publickey) mean?

SSH did not authenticate with an accepted key. Verify that the intended public key is registered and that its private key is available to SSH. ssh-add -l lists identities in a running agent; ssh-add ~/.ssh/id_ed25519 loads a key when that is the key you intend to use.

Is Authentication failed always HTTP 401, and 403 always authorization?

No. Those are useful broad distinctions, but a Git error message is not a reliable one-to-one map to HTTP status codes. Credential problems, token restrictions, SSO, server policy, and branch rules need the surrounding message and host-specific diagnostics.

See Git credentials, GitHub authentication, and personal access tokens.