About authentication to GitHub
To keep your account secure, you must authenticate before you can access resources on GitHub AE. When you authenticate to GitHub AE, you supply or confirm credentials that are unique to you to prove that you are exactly who you declare to be.
You can access your resources in GitHub AE in a variety of ways: in the browser, via GitHub Desktop or another desktop application, with the API, or via the command line. Each way of accessing GitHub AE supports different modes of authentication.
- Your identity provider (IdP)
- Personal access token
- SSH key
Authenticating in your browser
You can authenticate to GitHub AE in your browser using your IdP. For more information, see "About authentication with SAML single sign-on."
Authenticating with GitHub Desktop
You can authenticate with GitHub Desktop using your browser. For more information, see "Authenticating to GitHub in GitHub Desktop."
Authenticating with the API
You can authenticate with the API in different ways. For more information, see "Authenticating to the REST API."
Authenticating to the API with a personal access token
If you want to use the GitHub REST API for personal use, you can create a personal access token. For more information about creating a personal access token, see "Creating a personal access token."
Authenticating to the API with an app
If you want to use the API on behalf of an organization or another user, GitHub recommends that you use a GitHub App. For more information, see "About authentication with a GitHub App."
You can also create an OAuth token with an OAuth App to access the REST API. However, GitHub recommends that you use a GitHub App instead. GitHub Apps allow more control over the access and permission that the app has.
Authenticating to the API in a GitHub Actions workflow
If you want to use the API in a GitHub Actions workflow, GitHub recommends that you authenticate with the built-in GITHUB_TOKEN instead of creating a token. You can grant permissions to the GITHUB_TOKEN with the permissions key. For more information, see "Automatic token authentication."
Authenticating with the command line
You can access repositories on GitHub AE from the command line in two ways, HTTPS and SSH, and both have a different way of authenticating. The method of authenticating is determined based on whether you choose an HTTPS or SSH remote URL when you clone the repository. For more information about which way to access, see "About remote repositories."
HTTPS
You can work with all repositories on GitHub AE over HTTPS, even if you are behind a firewall or proxy.
If you authenticate with GitHub CLI, you can either authenticate with a personal access token or via the web browser. For more information about authenticating with GitHub CLI, see gh auth login.
If you authenticate without GitHub CLI, you must authenticate with a personal access token. When Git prompts you for your password, enter your personal access token. Alternatively, you can use a credential helper like Git Credential Manager. For more information, see "Creating a personal access token." Every time you use Git to authenticate with GitHub AE, you'll be prompted to enter your credentials to authenticate with GitHub AE, unless you cache them with a credential helper.
SSH
You can work with all repositories on GitHub AE over SSH, although firewalls and proxies might refuse to allow SSH connections.
If you authenticate with GitHub CLI, the CLI will find SSH public keys on your machine and will prompt you to select one for upload. If GitHub CLI does not find a SSH public key for upload, it can generate a new SSH public/private keypair and upload the public key to your account on GitHub AE. Then, you can either authenticate with a personal access token or via the web browser. For more information about authenticating with GitHub CLI, see gh auth login.
If you authenticate without GitHub CLI, you will need to generate an SSH public/private keypair on your local machine and add the public key to your account on GitHub AE. For more information, see "Generating a new SSH key and adding it to the ssh-agent." Every time you use Git to authenticate with GitHub AE, you'll be prompted to enter your SSH key passphrase, unless you've stored the key.
GitHub's token formats
GitHub issues tokens that begin with a prefix to indicate the token's type.
| Token type | Prefix | More information |
|---|---|---|
| Personal access token | ghp_ | "Creating a personal access token" |
| OAuth access token | gho_ | "Authorizing OAuth Apps" |
| User access token for a GitHub App | ghu_ | "Authenticating with a GitHub App on behalf of a user" |
| Installation access token for a GitHub App | ghs_ | "Authenticating as a GitHub App installation" |
| Refresh token for a GitHub App | ghr_ | "Refreshing user access tokens" |