Git "git@github.com: Permission denied (publickey)" - Deploy Key in CI

By Daniel Zoghalchali·Latchkey

SSH offered a key the server would not accept. With deploy keys the usual issue is that the specific key for this repo is not the one being offered, or the deploy key is on the wrong repo or lacks write access for a push.

What this error means

An SSH clone/push fails with git@github.com: Permission denied (publickey) and fatal: Could not read from remote repository. A different repo using its own deploy key works, which points at the key/repo pairing.

git clone output

git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

Diagnose it: depth, refs, or credentials?

Terminal

git rev-parse --is-shallow-repository
git rev-parse --abbrev-ref HEAD    # prints HEAD when detached
git log --oneline -3
git remote -v

Common causes

The deploy key is on the wrong repo

A deploy key is repo-specific. A key added to repo A cannot authenticate to repo B, so the server denies it.

The wrong key is offered

With several keys in the agent, SSH may offer a different identity first and never reach the deploy key, especially without IdentitiesOnly.

A read-only deploy key used for a push

A deploy key without write access authenticates for clone but is denied on push.

How to fix it

Pin the exact key per host

Configure SSH to use only the intended key for the host so the deploy key is offered first.

Terminal

cat >> ~/.ssh/config <<'EOF'
Host github.com
  IdentityFile ~/.ssh/deploy_key
  IdentitiesOnly yes
EOF
ssh -T git@github.com

Verify the deploy key and its access

Confirm the public key is added as a deploy key on this exact repository.
For pushes, enable "Allow write access" on the deploy key.
Use ssh -vT git@github.com to see which key is offered and accepted.

How to prevent it

Add a dedicated deploy key per repo and pin it with IdentitiesOnly yes.
Grant write access to deploy keys that must push.
Prefer actions/checkout’s ssh-key input, which wires the key correctly.

Frequently asked questions

What causes Git "git@github.com: permission denied (publickey)"?

There are 3 common causes: the deploy key is on the wrong repo, the wrong key is offered, and a read-only deploy key used for a push. A deploy key is repo-specific.

How do I fix Git "git@github.com: permission denied (publickey)"?

There are 2 fixes depending on which cause you have: pin the exact key per host and verify the deploy key and its access. Work through them in order, since the first is the most common.

What does Git "git@github.com: permission denied (publickey)" actually mean?

An SSH clone/push fails with git@github.com: Permission denied (publickey) and fatal: Could not read from remote repository.

How do I stop Git "git@github.com: permission denied (publickey)" happening again?

Add a dedicated deploy key per repo and pin it with IdentitiesOnly yes. The prevention section lists 3 changes that keep it from recurring.