A personal access token stands in for your GitHub password when git talks to GitHub over HTTPS or when a script calls the API. Create one under Settings, Developer settings, Personal access tokens, choose fine-grained unless you need a classic feature, and paste it when git asks for a password.
| Fine-grained | Classic | |
|---|---|---|
| Scope | Chosen repositories with per-area permissions | Broad scopes across every repository you can reach |
| GitHub's recommendation | Use by default | Only when fine-grained cannot do the job |
| Public repos you are not a member of | Cannot contribute | Can write |
| Several organisations in one token | No | Yes |
| Packages and Checks API | Not supported | Supported |
| Limit per account | 50 | No limit stated in the docs |
Updated
GitHub stopped accepting account passwords for git over HTTPS, so cloning a private repository or pushing from a server needs a token, an SSH key or a credential manager. This page helps you choose the token type, shows where to make it, and explains the safer ways to keep it on your machine instead of pasting it every time.
Choose GitHub.com, then HTTPS, then sign in through the browser. The CLI sets git up to use the stored credential.
gh auth login
gh auth status
git clone https://github.com/your-org/private-repo.gitType your GitHub username, then paste the token as the password. A credential helper can save it afterwards.
git clone https://github.com/your-org/private-repo.git
# Username for 'https://github.com': your-username
# Password for 'https://[email protected]': <paste token>Read the token from an environment variable so it never appears in the script file or in the repository's remote URL.
export GH_TOKEN="paste-token-here" # better: load from your secret store
curl -H "Authorization: Bearer $GH_TOKEN" https://api.github.com/userGitHub's own advice is to let the GitHub CLI or Git Credential Manager handle authentication. Run gh auth login, choose HTTPS, and git commands are authenticated from then on without a token in your clipboard.
Git Credential Manager ships with Git for Windows and can be installed on macOS and Linux. It keeps credentials in the system's secure store and handles two-factor sign in through the browser.
An organisation can require approval for fine-grained tokens, restrict them, or block classic ones. If your token works on personal repos but not on the company's, ask an organisation owner what the policy is.
GitHub no longer accepts your account password for git over HTTPS. When git prompts for a password, paste a personal access token instead, or switch to SSH, the GitHub CLI or Git Credential Manager.
Select the repositories, then under repository permissions set Contents to read and write. Add other permissions only if a script needs them, such as Pull requests or Issues.
You choose an expiry when you create one, and organisations can enforce a maximum. Separately, GitHub automatically revokes a personal access token that has not been used for a year.
Go to Settings, Developer settings, Personal access tokens, open the token and delete it. Any git remote or script using it stops working immediately, so replace it wherever it was stored.
Both work for git. SSH keys never expire unless you remove them and suit your own computer. Tokens suit HTTPS-only networks, scripts that also call the API, and cases where you want an automatic expiry.
Related: Git cheat sheet, Rename a git branch, API key generator, HTTP status codes.
Start for free or see all free tools. We.Inc is free to start, with no card needed. AI building is on paid plans from $20 a month.
We.Inc is an AI-powered website builder you can resell under your own brand. Launch a branded client dashboard, bill on Stripe Connect, and deliver AI-generated websites in minutes. White-label plans start at $99 a month for 25 client sites, with a 7-day free trial and no per-site fees.