# Git "Permission denied (publickey)" in CI - Fix SSH Auth

> Fix Git "git@github.com: Permission denied (publickey)" in CI - no SSH key loaded, the key not added to the host/repo, or the agent not running on the runner.

Source: https://latchkey.dev/learn/git/git-permission-denied-publickey  
Updated: 2026-06-25

The SSH server rejected every key the client offered. In CI this almost always means no private key is loaded on the runner, or the key that is loaded was never added to the Git host or granted access to the repo.

## Diagnose it: depth, refs, or credentials?

```Terminal
git rev-parse --is-shallow-repository
git rev-parse --abbrev-ref HEAD    # prints HEAD when detached
git log --oneline -3
git remote -v
```

> `actions/checkout` fetches depth 1 on a detached HEAD. Anything diffing against a base, reading a branch name, or running `git describe` needs `fetch-depth: 0`.

## FAQ

### What causes Git "Permission denied (publickey)" in CI?

There are 3 common causes: no private key loaded on the runner, the key is not registered with the host or repo, and wrong key permissions or no agent. The runner has no SSH key in its agent or ~/.ssh, so the client offers nothing and the server falls back to "publickey" denial.

### How do I fix Git "Permission denied (publickey)" in CI?

There are 3 fixes depending on which cause you have: load the deploy/ssh key on github actions, set up the agent and key manually, and confirm the key is authorized. Work through them in order, since the first is the most common.

### What does Git "Permission denied (publickey)" in CI actually mean?

An SSH clone/fetch fails with git@github.com: Permission denied (publickey) and then fatal: Could not read from remote repository.

### How do I stop Git "Permission denied (publickey)" in CI happening again?

Use the checkout action’s ssh-key input instead of hand-rolling SSH. The prevention section lists 3 changes that keep it from recurring.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt