# Git "Authentication failed" for HTTPS PAT in CI

> Fix the Git "fatal: Authentication failed" error for HTTPS in CI, caused by an invalid, expired, or insufficiently scoped personal access token.

Source: https://latchkey.dev/learn/git/git-authentication-failed-https-pat-in-ci  
Updated: 2026-06-26

The HTTPS credential Git supplied was rejected. The token is missing, expired, revoked, or lacks the scope for this repository, so the remote refuses authentication.

## Diagnose it: depth, refs, or credentials?

```Terminal
git rev-parse --is-shallow-repository
git rev-parse --abbrev-ref HEAD    # prints HEAD when detached
git log --oneline -3
git remote -v
```

> `actions/checkout` fetches depth 1 on a detached HEAD. Anything diffing against a base, reading a branch name, or running `git describe` needs `fetch-depth: 0`.

## FAQ

### What causes Git "Authentication failed" for HTTPS PAT in CI?

There are 3 common causes: missing, expired, or revoked token, insufficient token scope, and wrong username field. The PAT injected into the URL or credential helper is empty, past its expiry, or was rotated.

### How do I fix Git "Authentication failed" for HTTPS PAT in CI?

There are 2 fixes depending on which cause you have: supply a valid token correctly and grant the right scope. Work through them in order, since the first is the most common.

### What does Git "Authentication failed" for HTTPS PAT in CI actually mean?

A clone, fetch, or push over HTTPS fails with fatal: Authentication failed for the repository URL.

### How do I stop Git "Authentication failed" for HTTPS PAT in CI happening again?

Use short-lived, least-privilege fine-grained tokens scoped to the exact repos a job needs, and rotate them before expiry.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt