Olivier Lacan

Software bricoleur, word wrangler, scientific skeptic, and logic lumberjack.

Why is Git HTTPS not working on GitHub?

Written on December 22, 2013 in Orlando, FL & updated on December 02, 2015.

If you have no patience or aren't interested in my debugging process, skip to the last section.

On September 3rd, 2013 GitHub announced a long awaited implementation of two-factor authentication on github.com. Of course I immediately turned that feature on, and you should too.

Authentication failed

After setting up 2FA on GitHub, I moved on and forget about it. I imagined that my week would go on merrily, until one fateful day when I jumped into a repo and this happened:


1
2
3
$ git pull
remote: Invalid username or password.
fatal: Authentication failed for 'https://github.com/codeschool/kraken.git/'

I clearly remembered pulling from this same repository without a hitch a few weeks prior. How could my authentication suddenly fail. That damned osxkeychain credential helper felt like a perfect culprit, since I had issues with it in the past.

Strange. I definitely typed the correct password here.

Remembering that git has a way to talk to Keychain (the credential helper), I thought maybe it had stored the wrong password so I checked the credential helper for signs of life:


1
2
3
4
5
git config --global credential.helper
osxkeychain

$ git credential-osxkeychain
Usage: git credential-osxkeychain <get|store|erase>

Seemed all right. Maybe Keychain had the wrong password stored somehow?

Keychain

After checking my own Keychain, there was indeed a record in there that matched https://github.com:

Screenshot of the Keychain app showing a github.com entry

Since this obviously wasn't working I checked the info for that record:

Screenshot of the Keychain app entry info for github.com

It all checked out. The password was correct since I had just logged into github.com itself using it. You can even see that the git-credential-osxkeychain binary is allowed to access that credential from Keychain in the Access Control tab:

Screenshot of the Keychain app entry info access control tab for github.com

So it's not an access problem. What the hell is going on here? I decided to delete the Keychain record for github.com and try to re-submit them.


1
2
3
4
5
$ git pull
Username for 'https://github.com': olivierlacan
Password for 'https://olivierlacan@github.com':
remote: Invalid username or password.
fatal: Authentication failed for 'https://github.com/example/thing.git/'

Still not a fan of my password, uh.

It all makes sense now!

In a last effort, I googled the term "https github error" and found a GitHub Help article on HTTPS cloning errors. Since cloning didn't work either, I thought it could be useful. And that's when the answer jumped at me.

If you have enabled two-factor authentication, you must provide a personal access token instead of entering your password for HTTPS Git. You can create a personal access token for accessing GitHub by going to the application settings page.

It all makes sense now!

I willingly setup two-factor authentication on github.com and expected that my single-factor password would still work to authenticate through HTTPS via Git. And I probably glossed over some essential warning copy while doing so.

Screenshot of GitHub's Personal Access Tokens interface

Creating a new Personal Access Token on GitHub is easy and you get a hash to use as a password. That is what the osxkeychain credential helper saves to use whenever you use HTTPS to clone or pull GitHub repositories.

After the first prompt for credentials (on clone or pull), Git saves the credentials in your Keychain and everything works as it's supposed to.

Conclusion

Remember to make sure that you do have the keychain credential installed. If you do, you should see this:


1
2
3
4
5
git credential-osxkeychain
usage: git credential-osxkeychain <get|store|erase>

# to configure git to use it:
git config --global credential.helper osxkeychain

If you don't have the credential helper installed or if you're using an operating system other than OS X, read GitHub's new Caching your GitHub password in Git guide.

Outdated credentials stored in Keychain Access for github.com can also cause issues. GitHub now has a guide on how to delete outdated credentials from either the Keychain Access interface or from the credential helper.

PS: I highly recommend using GitHub's Hub wrapper for Git since it allows you to clone repos with a simple git clone rails/rails command. It automatically fetches the full HTTPS URL for you and uses that for the origin remote.