# Git "Permission denied (publickey)" in CI

> Fix the Git "git@github.com: Permission denied (publickey)" error in CI, caused by a missing SSH key, an unloaded agent, or a key the remote does not recognize.

Source: https://latchkey.dev/learn/git/git-permission-denied-publickey-in-ci  
Updated: 2026-06-26

The SSH handshake offered no key the remote accepts, so authentication failed before any repository access. In CI this usually means no key was loaded or the deploy key is not registered.

## Diagnose it: depth, refs, or credentials?

```Terminal
git rev-parse --is-shallow-repository
git rev-parse --abbrev-ref HEAD    # prints HEAD when detached
git log --oneline -3
git remote -v
```

> `actions/checkout` fetches depth 1 on a detached HEAD. Anything diffing against a base, reading a branch name, or running `git describe` needs `fetch-depth: 0`.

## FAQ

### What causes Git "Permission denied (publickey)" in CI?

There are 3 common causes: no ssh key available to the agent, key not registered with the repo or org, and wrong key permissions or format. The runner has no private key loaded, or the ssh-agent was never started, so nothing is offered to the server.

### How do I fix Git "Permission denied (publickey)" in CI?

There are 2 fixes depending on which cause you have: load the key into the agent and verify the key is authorized. Work through them in order, since the first is the most common.

### What does Git "Permission denied (publickey)" in CI actually mean?

A clone or push over SSH fails with git@github.com: Permission denied (publickey) and fatal: Could not read from remote repository.

### How do I stop Git "Permission denied (publickey)" in CI happening again?

Store the private key as a secret, load it via ssh-agent or actions/checkout ssh-key, and register the matching deploy key on every repo the job touches.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt