# Git "Authentication failed for ..." with a Token in CI

> Fix Git "fatal: Authentication failed for ..." when using a token in CI - an expired/revoked token, a fine-grained token missing this repo, or SSO not authorized for the PAT.

Source: https://latchkey.dev/learn/git/git-token-auth-failed  
Updated: 2026-06-25

A token was supplied but the host still rejected authentication. The token itself is the problem - expired, revoked, not granted this repository, or not SSO-authorized for the org.

## Diagnose it: depth, refs, or credentials?

```Terminal
git rev-parse --is-shallow-repository
git rev-parse --abbrev-ref HEAD    # prints HEAD when detached
git log --oneline -3
git remote -v
```

> `actions/checkout` fetches depth 1 on a detached HEAD. Anything diffing against a base, reading a branch name, or running `git describe` needs `fetch-depth: 0`.

## FAQ

### What causes Git "Authentication failed for ..." with a token in CI?

There are 3 common causes: expired or revoked token, fine-grained token missing this repository, and sso not authorized for the pat. A PAT or installation token that lapsed or was rotated authenticates no more.

### How do I fix Git "Authentication failed for ..." with a token in CI?

There are 2 fixes depending on which cause you have: rotate and re-store the token and scope the token to this repository. Work through them in order, since the first is the most common.

### What does Git "Authentication failed for ..." with a token in CI actually mean?

An HTTPS operation that passes a token fails with fatal: Authentication failed for 'https://github.com/org/repo.git/'.

### How do I stop Git "Authentication failed for ..." with a token in CI happening again?

Prefer short-lived App/installation tokens or OIDC over long-lived PATs. The prevention section lists 3 changes that keep it from recurring.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt