Fix: Git Keeps Asking for Username and Password

The Error

Every git push, git pull, or git fetch prompts for credentials:

Username for 'https://github.com': yourusername
Password for 'https://[email protected]':

Or after entering credentials once, Git asks again on the next command. Or you get an authentication failure even after entering the correct password:

remote: Support for password authentication was removed on August 13, 2021.
remote: Please see https://docs.github.com/en/get-started/getting-started-with-git/about-remote-repositories for information on currently supported authentication methods.
fatal: Authentication failed for 'https://github.com/user/repo.git'

Or Git was working before but suddenly asks for credentials again after a system update or password change.

Why This Happens

Git does not store credentials by default — it asks for them on every operation unless a credential helper is configured:

• No credential helper configured — git config credential.helper is empty, so Git can’t save or retrieve credentials.
• GitHub removed password authentication — GitHub stopped accepting account passwords for HTTPS Git operations in 2021. You must use a Personal Access Token (PAT) instead.
• Expired PAT or SSH key — credentials are stored but the token has expired or the SSH key was revoked.
• Wrong remote URL — the remote URL uses HTTPS when SSH is expected (or vice versa), causing the wrong authentication method.
• macOS Keychain has stale credentials — Git uses the macOS Keychain helper by default, but stored credentials may be outdated or corrupt.
• HTTPS proxy or corporate network — network changes (VPN, proxy) can cause credential lookups to fail even when credentials are stored.

Fix 1: Configure a Credential Helper

The credential helper tells Git where to store and retrieve credentials so it doesn’t ask every time.

macOS — use the built-in Keychain:

git config --global credential.helper osxkeychain

Windows — use Git Credential Manager:

git config --global credential.helper manager
# Or for older Git for Windows:
git config --global credential.helper wincred

Linux — cache credentials in memory:

# Cache for 15 minutes (900 seconds)
git config --global credential.helper cache

# Cache for 8 hours
git config --global credential.helper 'cache --timeout=28800'

Linux — store credentials permanently on disk:

# Stores credentials in plaintext at ~/.git-credentials (less secure)
git config --global credential.helper store

Verify the credential helper is set:

git config --global credential.helper
# Should output: osxkeychain (mac), manager (windows), cache/store (linux)

After setting the helper, the next time Git asks for credentials, enter them once — they’ll be saved and reused automatically.

Fix 2: Use a Personal Access Token (GitHub/GitLab/Bitbucket)

GitHub, GitLab, and most modern Git hosts no longer accept your account password for HTTPS Git operations. You need a Personal Access Token (PAT):

GitHub — create a PAT:

1. Go to GitHub → Settings → Developer settings → Personal access tokens → Tokens (classic)
2. Click “Generate new token (classic)”
3. Select scopes: repo (for private repos), read:org if needed
4. Copy the token immediately — it’s only shown once

Use the PAT as your password:

# When Git prompts for credentials:
Username: your-github-username
Password: ghp_xxxxxxxxxxxxxxxxxxxx  ← Paste your PAT here, not your account password

Or embed the PAT directly in the remote URL (not recommended for shared machines):

git remote set-url origin https://your-username:[email protected]/user/repo.git

Warning: Embedding a PAT in the remote URL stores it in .git/config in plaintext. Anyone with access to the repo directory can read it. Use a credential helper instead.

GitLab — create an access token:

1. Profile → Preferences → Access Tokens
2. Create token with read_repository and write_repository scopes

Bitbucket — create an app password:

1. Account settings → App passwords → Create app password
2. Select Repository read/write permissions

Fix 3: Switch from HTTPS to SSH

SSH authentication doesn’t require a password every time (once your SSH key is loaded into the agent). Switching to SSH eliminates credential prompts entirely:

Generate an SSH key if you don’t have one:

# Generate a new SSH key (Ed25519 is recommended)
ssh-keygen -t ed25519 -C "[email protected]"

# Default location: ~/.ssh/id_ed25519 (private key) and ~/.ssh/id_ed25519.pub (public key)

Add the public key to your Git host:

# Copy the public key
cat ~/.ssh/id_ed25519.pub
# Paste this into GitHub → Settings → SSH and GPG keys → New SSH key

Test the SSH connection:

ssh -T [email protected]
# Hi username! You've successfully authenticated, but GitHub does not provide shell access.

Switch the remote from HTTPS to SSH:

# Check current remote URL
git remote -v
# origin  https://github.com/user/repo.git (fetch)

# Switch to SSH
git remote set-url origin [email protected]:user/repo.git

# Verify
git remote -v
# origin  [email protected]:user/repo.git (fetch)

Start the SSH agent and add your key:

# Start ssh-agent
eval "$(ssh-agent -s)"

# Add your private key
ssh-add ~/.ssh/id_ed25519

# On macOS — add to Keychain permanently
ssh-add --apple-use-keychain ~/.ssh/id_ed25519

Configure SSH to use your key automatically (add to ~/.ssh/config):

Host github.com
    HostName github.com
    User git
    IdentityFile ~/.ssh/id_ed25519
    AddKeysToAgent yes
    UseKeychain yes    # macOS only

Fix 4: Fix macOS Keychain Stale Credentials

If you changed your GitHub password or PAT, the macOS Keychain may still have the old credentials. Git will fail silently using the stale data:

# Remove stale credentials from Keychain
git credential-osxkeychain erase
host=github.com
protocol=https
# Press Enter, then Ctrl+D

# Or use the Keychain Access app (macOS):
# Search for "github.com" → delete the entry → Git will prompt for new credentials

Or reset via the macOS CLI:

# List keychain entries for github.com
security find-internet-password -s github.com

# Delete the stored credentials
security delete-internet-password -s github.com

Force Git to re-authenticate:

# Clear stored credentials and re-enter
git credential reject <<EOF
protocol=https
host=github.com
EOF

# On next git push/pull, Git will prompt for credentials and save them fresh

Fix 5: Fix Git Credential Manager (Windows/Cross-platform)

Git Credential Manager (GCM) is the recommended helper for Windows and cross-platform setups:

# Check if GCM is installed
git credential-manager --version

# Install GCM (if not installed)
# macOS via Homebrew:
brew install --cask git-credential-manager

# Windows — included with Git for Windows
# Linux — see https://github.com/git-ecosystem/git-credential-manager

# Configure Git to use GCM
git config --global credential.helper manager

# Clear a cached credential
git credential-manager github logout

GCM supports GitHub OAuth (no PAT needed):

# After configuring GCM, the first git push will open a browser for OAuth login
git push origin main
# → Opens browser → Authorize Git Credential Manager → Credentials saved

Fix 6: Configure Per-Repository Credentials

If you use multiple accounts (personal and work), set credentials per repository instead of globally:

# In the repository directory (not --global)
git config credential.helper store

# Or set the URL with credentials embedded (use carefully)
git remote set-url origin https://[email protected]/company/repo.git
# Git will only prompt for the password for this specific host/username combination

Use SSH with multiple accounts:

# ~/.ssh/config
Host github-personal
    HostName github.com
    User git
    IdentityFile ~/.ssh/id_ed25519_personal

Host github-work
    HostName github.com
    User git
    IdentityFile ~/.ssh/id_ed25519_work

# Personal repo — use github-personal host alias
git remote set-url origin git@github-personal:personal-user/repo.git

# Work repo — use github-work host alias
git remote set-url origin git@github-work:company/repo.git

Still Not Working?

Check the global Git config to see what credential helper is set:

git config --global --list | grep credential
# credential.helper=osxkeychain  (or manager, cache, store)

Check if a local repo config overrides the global:

git config --local --list | grep credential
# If credential.helper= (empty string), it disables the global helper

An empty credential.helper= in local config disables the global helper. Fix it:

# Remove the local override
git config --local --unset credential.helper

# Or explicitly set it to the global helper
git config --local credential.helper osxkeychain

Check the remote URL format — mixing HTTPS and SSH causes confusion:

git remote -v
# If it shows https:// → use PAT or credential helper
# If it shows git@ → use SSH key

For corporate environments with NTLM/Kerberos authentication:

# Use Git Credential Manager which handles Windows authentication natively
git config --global credential.helper manager

# Or configure the http proxy
git config --global http.proxy http://proxy.company.com:8080

For related Git authentication issues, see Fix: Git Permission Denied (publickey) and Fix: Git Push Rejected Non-Fast-Forward.