Git LFS "Authentication required" credentials error in CI

By Kaveh Alemi·Latchkey

The LFS server challenged the request for credentials and none were provided. On a CI runner there is no interactive prompt, so the fetch fails immediately with "Authentication required".

What this error means

A fetch prints "Authentication required: Authentication required for https://github.com/acme/app.git/info/lfs" and the checkout aborts.

batch response: Authentication required: Authentication required for
https://github.com/acme/app.git/info/lfs/objects/batch
error: failed to fetch some objects

Common causes

No token was passed to the checkout

A bare git clone in a step without the persisted credentials from actions/checkout sends anonymous LFS requests that are challenged.

A private repo cloned without credentials

For a private repo, the LFS endpoint always requires auth; without a token the batch request is rejected before any object transfers.

How to fix it

Let checkout persist credentials and enable LFS

1. Use actions/checkout with lfs: true; it configures the token for LFS.
2. For manual clones, supply the token in the URL or via the git credential helper.
3. Re-run so the batch request carries credentials.

- uses: actions/checkout@v4
  with:
    lfs: true

Provide credentials for a manual clone

When cloning outside the checkout action, embed a token so LFS can authenticate.

git clone https://x-access-token:${GITHUB_TOKEN}@github.com/acme/app.git

Using this in CI

CI checkouts are shallow and detached by default, which changes the answer this command gives you. Commands that read history, branch names, or tags need the checkout configured for it.

- uses: actions/checkout@v4
  with:
    fetch-depth: 0   # history, tags, and git describe all need this

- run: |
    git rev-parse --is-shallow-repository   # expect false
    git rev-parse --abbrev-ref HEAD          # prints HEAD when detached

How to prevent it

• Prefer actions/checkout with lfs: true so credentials persist.
• Never rely on interactive auth on a CI runner.
• Store manual-clone tokens in secrets, not in logs.

Frequently asked questions

Related guides

References

• Git reference manual
• GitHub Actions documentation