Git Push 403 - Token Lacks Scope or Permission in CI

By Daniel Zoghalchali·Latchkey

The token is valid - authentication passed - but it does not carry the permission the operation needs. A push or a write to a protected resource returns 403 because the token’s scope or the workflow’s permissions block is too narrow.

What this error means

Authentication succeeds but the operation fails with a 403 and remote: Permission to org/repo.git denied. Read may work while write fails, or one repo works while another is forbidden.

git push output

remote: Permission to org/repo.git denied to github-actions[bot].
fatal: unable to access 'https://github.com/org/repo.git/': The requested URL
returned error: 403

Diagnose it: depth, refs, or credentials?

Terminal

git rev-parse --is-shallow-repository
git rev-parse --abbrev-ref HEAD    # prints HEAD when detached
git log --oneline -3
git remote -v

Common causes

GITHUB_TOKEN has read-only permissions

By default the workflow token may be read-only (or restricted per the repo setting). A push then fails 403 even though the token is valid, because it lacks contents: write.

A PAT is missing the required scope

A classic PAT without repo scope, or a fine-grained PAT without the repository’s Contents: read/write permission, authenticates but cannot perform the action.

The token has no access to that repository

A fine-grained token or App installation scoped to a different set of repos can read nothing in this one, so even a fetch is forbidden.

How to fix it

Grant the workflow the write permission it needs

Raise the permissions block so GITHUB_TOKEN can push.

.github/workflows/ci.yml

permissions:
  contents: write   # allow the job to push commits/tags

Use a PAT with the right scope/permissions

For a classic PAT, include the repo scope (and workflow if editing workflows).
For a fine-grained PAT, grant the target repos Contents: read and write.
Confirm the token’s repository access list includes this repo.

How to prevent it

Declare an explicit least-privilege permissions block in every workflow.
Prefer fine-grained tokens scoped to specific repos and permissions.
Document which scope each automation step requires.

Frequently asked questions

What causes Git push 403?

There are 3 common causes: github_token has read-only permissions, a pat is missing the required scope, and the token has no access to that repository. By default the workflow token may be read-only (or restricted per the repo setting).

How do I fix Git push 403?

There are 2 fixes depending on which cause you have: grant the workflow the write permission it needs and use a pat with the right scope/permissions. Work through them in order, since the first is the most common.

What does Git push 403 actually mean?

Authentication succeeds but the operation fails with a 403 and remote: Permission to org/repo.git denied.

How do I stop Git push 403 happening again?

Declare an explicit least-privilege permissions block in every workflow. The prevention section lists 3 changes that keep it from recurring.