Connecting to GitHub: HTTPS Tokens and SSH Keys
Authenticate Git with GitHub securely: use a credential manager or personal access token over HTTPS, or generate an SSH key, add it to GitHub and switch your remote to SSH.
On this page 12 sections
Introduction
Before GitHub lets you push, it needs proof that you are allowed to. Since August 2021, GitHub no longer accepts your account password for Git operations — a password typed into the terminal is rejected. There are two secure ways to connect instead, and this lesson sets up both so you can choose.
- The difference between HTTPS and SSH connections.
- How to sign in over HTTPS with a credential manager or personal access token.
- How to create an SSH key, add it to GitHub and test it.
- How to switch an existing repository from HTTPS to SSH.
HTTPS or SSH?
| HTTPS | SSH | |
|---|---|---|
| Remote URL looks like | https://github.com/priya-sharma/my-portfolio.git | git@github.com:priya-sharma/my-portfolio.git |
| You prove who you are with | A browser sign-in (credential manager) or a personal access token | A key pair stored on your computer |
| Setup | Easiest — often automatic | A few one-time steps |
| Works through strict firewalls | Almost always (port 443) | Usually (port 22; GitHub also offers SSH over 443) |
Both are equally secure when set up properly. Beginners usually start with HTTPS because it can work with no setup at all; many developers switch to SSH later because it never asks for anything once configured.
HTTPS with a Credential Manager
Git for Windows includes Git Credential Manager. The first time you push over HTTPS, it opens a browser window where you sign in to GitHub; it then stores a secure token so you are not asked again. On macOS and Linux you can install Git Credential Manager too, or use the GitHub CLI: after installing gh, run gh auth login and follow the prompts.
Without a credential manager, Git asks for a username and password in the terminal. In the password prompt, paste a personal access token (PAT) instead of your GitHub password. Create one on GitHub under Settings → Developer settings → Personal access tokens. Prefer a fine-grained token, limited to the repositories it needs and with an expiry date.
A personal access token grants access to your account. Never commit it, paste it into chat or put it in a URL. If one leaks, delete it on GitHub immediately and create a new one.
Generate an SSH Key
SSH uses a key pair: a private key that never leaves your computer, and a public key you give to GitHub. Create a pair with the modern Ed25519 algorithm, using your GitHub email as a label:
ssh-keygen -t ed25519 -C "priya@example.com"It asks where to save the key — press Enter to accept the default — and then for a passphrase. A passphrase encrypts the private key, so a stolen laptop does not mean a stolen key; you can type it once per session with ssh-agent (below). Afterwards you will see something like this (your fingerprint and picture will differ):
Click Run to see what this code prints.
ls ~/.sshClick Run to see what this code prints.
id_ed25519 is the private key — keep it secret. id_ed25519.pub is the public key, safe to share. To avoid typing your passphrase for every push, load the key into the SSH agent for the session:
eval "$(ssh-agent -s)"ssh-add ~/.ssh/id_ed25519Add the Key to GitHub
Print the public key and copy the whole line:
cat ~/.ssh/id_ed25519.pubClick Run to see what this code prints.
- On GitHub, open your profile picture menu → Settings → SSH and GPG keys.
- Click “New SSH key”.
- Give it a title that names the computer, such as “Priya’s laptop”, and keep the type as Authentication Key.
- Paste the public key (starting with ssh-ed25519) into the Key box and click “Add SSH key”.
A tutorial tells Priya to paste her SSH key into GitHub. She runs cat ~/.ssh/id_ed25519 and pastes the result. What is wrong?
Test the Connection
ssh -T git@github.comThe first time, SSH asks whether you trust the server and shows its fingerprint. Check that it matches GitHub’s published Ed25519 fingerprint before typing yes — this protects you against connecting to an impostor:
Click Run to see what this code prints.
Once your key is accepted, GitHub replies with a greeting that includes your username, of the form “Hi priya-sharma! You've successfully authenticated, but GitHub does not provide shell access.” That message means it worked — GitHub does not offer a shell, it only confirms who you are.
Switch a Remote to SSH
Repositories you clone with an SSH URL use SSH automatically. To switch an existing HTTPS repository, change the remote URL:
git remote -vClick Run to see what this code prints.
git remote set-url origin git@github.com:priya-sharma/my-portfolio.gitgit remote -vClick Run to see what this code prints.
From now on, git push and git pull for this repository use your SSH key. You can copy the SSH URL of any repository from the green “Code” button on GitHub.
Put the SSH setup steps in order.
- Switch the remote with git remote set-url origin git@github.com:…
- Copy the public key from the .pub file
- Add the private key to the SSH agent with ssh-add
- Add the public key on GitHub under Settings → SSH and GPG keys
- Test with ssh -T git@github.com
- Generate a key pair with ssh-keygen -t ed25519
Keeping Keys Safe
- Never share, email or commit a private key or token.
- Use a passphrase on SSH keys, especially on laptops.
- Create one key per computer, so you can revoke a lost laptop’s key without affecting the others.
- Review Settings → SSH and GPG keys and Personal access tokens occasionally, and delete anything you no longer use.
- Turn on two-factor authentication for your GitHub account.
Common Mistakes
- Typing your GitHub account password at the Git prompt — it is rejected; use a token or a credential manager.
- Pasting the private key into GitHub instead of the .pub file.
- Adding the key to GitHub but testing with the HTTPS URL still set, then wondering why you are asked for a password.
- Typing yes to a host fingerprint without checking it.
Frequently Asked Questions
GitHub did not accept any of your keys. Check that the public key is added to your GitHub account, that the agent has it (ssh-add -l lists loaded keys), and that you are testing with git@github.com.
Yes — you can add the same public key to several services. Many people still prefer separate keys so each can be revoked independently.
You may be pushing to a repository you do not have write access to. For someone else’s project, fork it and push to your fork instead (lesson 13).
Key Takeaways
- GitHub does not accept account passwords for Git operations.
- HTTPS works with a credential manager (browser sign-in), the GitHub CLI or a personal access token.
- SSH uses a key pair: keep the private key secret and add the .pub key to GitHub.
- Test SSH with ssh -T git@github.com, checking GitHub’s fingerprint the first time.
- git remote set-url origin <ssh-url> switches an existing repository to SSH.
Summary
Priya can now push securely from any of her computers. With GitHub connected, she is ready for the heart of team collaboration: pull requests, where code is proposed, reviewed and discussed before it reaches main.