Cargo "failed to authenticate when downloading repository" in CI

Cargo tried to clone a private git dependency and the runner had no credentials it could use. Without an SSH key or a token, the git host rejects the fetch and Cargo cannot load the dependency.

What this error means

cargo fails fetching a git = "..." dependency with failed to authenticate when downloading repository, often listing the SSH/credential methods it attempted. It works locally (where your key or credential helper exists) but not on the bare runner.

error: failed to get `internal` as a dependency of package `app v0.1.0`

Caused by:
  failed to authenticate when downloading repository: git@github.com:acme/internal.git

  * attempted ssh-agent authentication, but no usernames succeeded

Common causes

No credentials for the private repo on the runner

A private git dependency needs an SSH key or a token. CI starts with neither unless you provide one, so authentication fails.

SSH URL but no ssh-agent / key configured

An ssh:///git@ dependency URL requires a key loaded into ssh-agent. On a runner with no key, Cargo’s ssh-agent attempt finds no usable identity.

How to fix it

Use a token over HTTPS with the git CLI

Let Cargo shell out to the git CLI and rewrite the URL to embed a CI token.

export CARGO_NET_GIT_FETCH_WITH_CLI=true
git config --global url."https://x-access-token:${{ secrets.GH_PAT }}@github.com/".insteadOf "https://github.com/"
cargo fetch --locked

Or provide an SSH deploy key

Load a deploy key into ssh-agent for git@/ssh:// dependency URLs.

- uses: webfactory/ssh-agent@v0.9.0
  with:
    ssh-private-key: ${{ secrets.DEPLOY_KEY }}
- run: cargo fetch --locked

How to prevent it

• Set CARGO_NET_GIT_FETCH_WITH_CLI=true so git’s own auth (and helpers) apply.
• Inject a scoped token or deploy key as a CI secret for private git deps.
• Pin git dependencies to a rev so clones are reproducible once auth works.

Related guides