# Git "fatal: Authentication failed" over HTTPS in CI

> Fix Git "fatal: Authentication failed for ..." over HTTPS in CI - a missing or invalid token, an expired credential, or the wrong username supplied to the remote.

Source: https://latchkey.dev/learn/git/git-authentication-failed  
Updated: 2026-06-25

The remote rejected the HTTPS credential. The connection reached the server, but the username/token pair was missing, wrong, or expired - so authentication failed before any repository data moved.

## Diagnose it: depth, refs, or credentials?

```Terminal
git rev-parse --is-shallow-repository
git rev-parse --abbrev-ref HEAD    # prints HEAD when detached
git log --oneline -3
git remote -v
```

> `actions/checkout` fetches depth 1 on a detached HEAD. Anything diffing against a base, reading a branch name, or running `git describe` needs `fetch-depth: 0`.

## FAQ

### What causes Git "fatal: authentication failed" over HTTPS in CI?

There are 3 common causes: missing or invalid token, expired or rotated credential, and wrong username with the token. No credential was supplied, or the token is wrong/revoked.

### How do I fix Git "fatal: authentication failed" over HTTPS in CI?

There are 3 fixes depending on which cause you have: embed a token in the remote url, let actions/checkout handle auth, and rotate and re-store an expired token. Work through them in order, since the first is the most common.

### What does Git "fatal: authentication failed" over HTTPS in CI actually mean?

A clone, fetch, or push over HTTPS fails with fatal: Authentication failed for 'https://github.com/org/repo.git/'.

### How do I stop Git "fatal: authentication failed" over HTTPS in CI happening again?

Use short-lived App/installation tokens or OIDC instead of long-lived PATs. The prevention section lists 3 changes that keep it from recurring.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt