Git "remote: Invalid username or password" in CI

By Kaveh Alemi·Latchkey

The host rejected the HTTPS credential as invalid. The connection reached the server, but the username/password (or token) pair was wrong, empty, or used a password where a token is required.

What this error means

A clone/fetch/push over HTTPS fails with remote: Invalid username or password followed by fatal: Authentication failed. It is deterministic - the same credential fails every time until corrected.

git output

remote: Invalid username or password.
fatal: Authentication failed for 'https://github.com/org/repo.git/'

Diagnose it: depth, refs, or credentials?

Terminal

git rev-parse --is-shallow-repository
git rev-parse --abbrev-ref HEAD    # prints HEAD when detached
git log --oneline -3
git remote -v

Common causes

A password supplied where a token is required

GitHub does not accept account passwords for Git over HTTPS. A password in the helper or URL is rejected as invalid.

Empty or malformed credential

A secret that resolved to empty (unset variable, wrong secret name) sends a blank username/password the server rejects.

Mismatched username/token pair

An installation token must pair with the username x-access-token; a PAT pairs with your username. The wrong username with the token reads as invalid.

How to fix it

Use the correct username/token pairing

Pair an installation token with x-access-token, or a PAT with your username.

Terminal

# installation/App token:
git clone https://x-access-token:${GITHUB_TOKEN}@github.com/org/repo.git
# personal access token:
git clone https://USERNAME:${PAT}@github.com/org/repo.git

Confirm the secret actually resolved

Verify the secret/env name is correct and non-empty (a typo yields an empty credential).
Ensure the token has not expired or been revoked.
Re-store a freshly generated token in the CI secret if in doubt.

How to prevent it

Never use account passwords for Git automation - use tokens or SSH.
Pair installation tokens with x-access-token and PATs with your username.
Guard against empty secrets by asserting the credential is set before use.

Frequently asked questions

What causes Git "remote: invalid username or password" in CI?

There are 3 common causes: a password supplied where a token is required, empty or malformed credential, and mismatched username/token pair. GitHub does not accept account passwords for Git over HTTPS.

How do I fix Git "remote: invalid username or password" in CI?

There are 2 fixes depending on which cause you have: use the correct username/token pairing and confirm the secret actually resolved. Work through them in order, since the first is the most common.

What does Git "remote: invalid username or password" in CI actually mean?

A clone/fetch/push over HTTPS fails with remote: Invalid username or password followed by fatal: Authentication failed.

How do I stop Git "remote: invalid username or password" in CI happening again?

Never use account passwords for Git automation - use tokens or SSH. The prevention section lists 3 changes that keep it from recurring.