Git LFS "batch response: ... 403" authentication error in CI

The LFS batch endpoint returned 403 Forbidden. The credentials reached the server but the token is not authorized to read (or push) the LFS objects for this repository.

What this error means

checkout or git lfs pull stops with "batch response: Forbidden" and "error: failed to fetch some objects", while ordinary git clone of the pointer files succeeds.

batch response: Forbidden: https://github.com/acme/app.git/info/lfs/objects/batch
error: failed to fetch some objects from 'https://github.com/acme/app.git/info/lfs'

Common causes

The token lacks contents permission

A restricted GITHUB_TOKEN (or a PAT without repo/contents scope) can read pointers over HTTPS but is refused by the LFS batch API, which needs contents access.

LFS objects live in a different repo than the token covers

When objects are stored on a fork or a separate LFS-backing repo, a token scoped only to the current repo is forbidden from those objects.

How to fix it

Grant contents read to the workflow token

1. Add permissions: contents: read to the workflow or job.
2. For cross-repo LFS, pass a PAT with access to the object repo via the checkout token input.
3. Re-run so the batch API authorizes the fetch.

permissions:
  contents: read
jobs:
  build:
    steps:
      - uses: actions/checkout@v4
        with:
          lfs: true

Use a scoped token for cross-repo objects

When LFS objects are hosted elsewhere, supply a token that can read that repository so the batch request is not forbidden.

- uses: actions/checkout@v4
  with:
    lfs: true
    token: ${{ secrets.LFS_READ_TOKEN }}

How to prevent it

• Set explicit permissions: so the token has contents access for LFS.
• Store cross-repo LFS tokens as secrets, not in the workflow.
• Prefer the built-in token where the objects live in the same repo.

Related guides