Git LFS "Authentication required" / 401 in CI

The repository cloned, but the separate LFS batch API rejected the request for lack of credentials. LFS authenticates against its own endpoint, so a token that read the Git refs may still be refused for object transfer.

What this error means

A git lfs pull or LFS-enabled checkout fails with Authentication required / a 401 from the LFS batch endpoint, even though the plain git clone of the same repo succeeded.

git lfs output

batch response: Authentication required: Authorization error:
https://github.com/org/repo.git/info/lfs/objects/batch
Check that you have proper access to the repository
error: failed to fetch some objects from
'https://github.com/org/repo.git/info/lfs'

Common causes

No credentials passed to the LFS endpoint

LFS uses a distinct batch API. If the runner authenticated for the Git transport but the credential is not made available to LFS, the object transfer request is unauthorized.

Token lacks access to LFS objects

A token that can read refs but lacks Contents permission, or is scoped to the wrong repo, is rejected by the LFS endpoint for object access.

SSH clone with no LFS credential bridge

When cloning over SSH, LFS still talks HTTPS to the batch API. Without a credential helper bridging to HTTPS, the LFS request has no auth.

How to fix it

Provide a token the LFS endpoint accepts

Use the checkout action with a token that has Contents access, and enable LFS so it is wired through.

.github/workflows/ci.yml

- uses: actions/checkout@v4
  with:
    lfs: true
    token: ${{ secrets.REPO_PAT }}   # Contents: read on the repo

Configure credentials for LFS over HTTPS

Ensure a credential helper supplies a token to the HTTPS LFS endpoint, even on an SSH clone.

Terminal

git config --global credential.helper store
printf "https://x-access-token:%s@github.com\n" "$GITHUB_TOKEN" > ~/.git-credentials
git lfs pull

How to prevent it

Use a token with Contents access for LFS jobs, not just ref read.
Enable lfs: true and pass the token through the checkout action.
Bridge SSH clones to an HTTPS credential helper for the LFS batch API.