# Git LFS "batch response: ... 403" authentication error in CI

> Fix Git LFS "batch response: Forbidden" / 403 in CI - the LFS batch API authenticated the request but the token lacks permission to read or write the objects.

Source: https://latchkey.dev/learn/command-reference/git-lfs-batch-403-auth-in-ci  
Updated: 2026-06-30

The LFS batch endpoint returned 403 Forbidden. The credentials reached the server but the token is not authorized to read (or push) the LFS objects for this repository.

## Using this in CI

CI checkouts are shallow and detached by default, which changes the answer this command gives you. Commands that read history, branch names, or tags need the checkout configured for it.

```.github/workflows/ci.yml
- uses: actions/checkout@v4
  with:
    fetch-depth: 0   # history, tags, and git describe all need this

- run: |
    git rev-parse --is-shallow-repository   # expect false
    git rev-parse --abbrev-ref HEAD          # prints HEAD when detached
```

> `git rev-parse --abbrev-ref HEAD` returns the literal string `HEAD` on a detached checkout rather than a branch name. On GitHub Actions read `github.ref_name` instead; the git command cannot know what it was checked out for.

## FAQ

### What causes Git LFS "batch response: ... 403" authentication error in CI?

There are 2 common causes: the token lacks contents permission and lfs objects live in a different repo than the token covers. A restricted GITHUB_TOKEN (or a PAT without repo/contents scope) can read pointers over HTTPS but is refused by the LFS batch API, which needs contents access.

### How do I fix Git LFS "batch response: ... 403" authentication error in CI?

There are 2 fixes depending on which cause you have: grant contents read to the workflow token and use a scoped token for cross-repo objects. Work through them in order, since the first is the most common.

### What does Git LFS "batch response: ... 403" authentication error in CI actually mean?

checkout or git lfs pull stops with "batch response: Forbidden" and "error: failed to fetch some objects", while ordinary git clone of the pointer files succeeds.

### How do I stop Git LFS "batch response: ... 403" authentication error in CI happening again?

Set explicit permissions: so the token has contents access for LFS. The prevention section lists 3 changes that keep it from recurring.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt