# Git Push 403 - Token Lacks Scope or Permission in CI

> Fix Git "remote: Permission ... denied" / 403 in CI - a PAT, fine-grained token, or GITHUB_TOKEN that authenticates but lacks the scope or repo permission to read or write.

Source: https://latchkey.dev/learn/git/git-token-insufficient-scope  
Updated: 2026-06-25

The token is valid - authentication passed - but it does not carry the permission the operation needs. A push or a write to a protected resource returns 403 because the token’s scope or the workflow’s `permissions` block is too narrow.

## Diagnose it: depth, refs, or credentials?

```Terminal
git rev-parse --is-shallow-repository
git rev-parse --abbrev-ref HEAD    # prints HEAD when detached
git log --oneline -3
git remote -v
```

> `actions/checkout` fetches depth 1 on a detached HEAD. Anything diffing against a base, reading a branch name, or running `git describe` needs `fetch-depth: 0`.

## FAQ

### What causes Git push 403?

There are 3 common causes: github_token has read-only permissions, a pat is missing the required scope, and the token has no access to that repository. By default the workflow token may be read-only (or restricted per the repo setting).

### How do I fix Git push 403?

There are 2 fixes depending on which cause you have: grant the workflow the write permission it needs and use a pat with the right scope/permissions. Work through them in order, since the first is the most common.

### What does Git push 403 actually mean?

Authentication succeeds but the operation fails with a 403 and remote: Permission to org/repo.git denied.

### How do I stop Git push 403 happening again?

Declare an explicit least-privilege permissions block in every workflow. The prevention section lists 3 changes that keep it from recurring.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt