GitHub "Support for password authentication was removed" in CI

By Kaveh Alemi·Latchkey

GitHub stopped accepting account passwords for Git operations over HTTPS. A pipeline still sending a password is rejected and told to use a personal access token instead.

What this error means

An HTTPS clone/push fails with remote: Support for password authentication was removed followed by fatal: Authentication failed. It started failing after a credential that used to be a password was no longer accepted.

remote: Support for password authentication was removed on August 13, 2021.
remote: Please see https://docs.github.com/get-started/getting-started-with-git/about-remote-repositories
for information on currently recommended modes of authentication.
fatal: Authentication failed for 'https://github.com/org/repo.git/'

Diagnose it: depth, refs, or credentials?

git rev-parse --is-shallow-repository
git rev-parse --abbrev-ref HEAD    # prints HEAD when detached
git log --oneline -3
git remote -v

Common causes

A raw account password is being sent

The remote URL or credential helper still supplies an account password. GitHub no longer accepts that for Git over HTTPS and rejects the request.

A stored credential predates the token requirement

An old cached credential (in a credential helper or a baked-in URL) holds a password. Until it is replaced with a token, every HTTPS operation fails.

How to fix it

Use a personal access token in place of the password

Supply a PAT (fine-grained or classic) where the password used to go.

git remote set-url origin https://USERNAME:${PAT}@github.com/org/repo.git
# or use the credential helper with the PAT as the "password"

Switch to an App/installation token or SSH

1. For GitHub Actions same-repo work, use the built-in GITHUB_TOKEN.
2. For cross-repo access, mint a short-lived GitHub App installation token.
3. Or move the remote to SSH and authenticate with a deploy key.

How to prevent it

• Never use account passwords for Git automation.
• Prefer short-lived App/installation tokens or OIDC for CI.
• Replace any cached password credentials with tokens.

Frequently asked questions

Related guides

References

• Git reference manual
• GitHub Actions documentation