Git "Authentication failed" for HTTPS PAT in CI

By Kaveh Alemi·Latchkey

The HTTPS credential Git supplied was rejected. The token is missing, expired, revoked, or lacks the scope for this repository, so the remote refuses authentication.

What this error means

A clone, fetch, or push over HTTPS fails with fatal: Authentication failed for the repository URL. It fails the same way every time.

git

remote: Invalid username or password.
fatal: Authentication failed for 'https://github.com/org/repo.git/'

Diagnose it: depth, refs, or credentials?

Terminal

git rev-parse --is-shallow-repository
git rev-parse --abbrev-ref HEAD    # prints HEAD when detached
git log --oneline -3
git remote -v

Common causes

Missing, expired, or revoked token

The PAT injected into the URL or credential helper is empty, past its expiry, or was rotated.

Insufficient token scope

A classic PAT without repo scope, or a fine-grained token without access to this repository, cannot authenticate for it.

Wrong username field

For an HTTPS token the username should be a placeholder like x-access-token (or the PAT itself), not your account password.

How to fix it

Supply a valid token correctly

Store the PAT as a secret and inject it as the password with an x-access-token username.
Confirm the token has not expired.

.github/workflows/ci.yml

git clone https://x-access-token:${{ secrets.GH_PAT }}@github.com/org/repo.git

Grant the right scope

For classic PATs, enable repo scope.
For fine-grained PATs, add repository access plus Contents read/write.

How to prevent it

Use short-lived, least-privilege fine-grained tokens scoped to the exact repos a job needs, and rotate them before expiry. Authentication failures are deterministic, so a retry will not fix bad credentials.

Frequently asked questions

What causes Git "Authentication failed" for HTTPS PAT in CI?

There are 3 common causes: missing, expired, or revoked token, insufficient token scope, and wrong username field. The PAT injected into the URL or credential helper is empty, past its expiry, or was rotated.

How do I fix Git "Authentication failed" for HTTPS PAT in CI?

There are 2 fixes depending on which cause you have: supply a valid token correctly and grant the right scope. Work through them in order, since the first is the most common.

What does Git "Authentication failed" for HTTPS PAT in CI actually mean?

A clone, fetch, or push over HTTPS fails with fatal: Authentication failed for the repository URL.

How do I stop Git "Authentication failed" for HTTPS PAT in CI happening again?

Use short-lived, least-privilege fine-grained tokens scoped to the exact repos a job needs, and rotate them before expiry.