SSH Keys and Git Authentication

SSH keys

A key pair has two parts. The private key proves your identity and must never leave your machine. The public key can be shared freely and is registered in your account on the Git host.

ssh-keygen -t ed25519 -C "you@example.com"   # creates id_ed25519 and id_ed25519.pub in ~/.ssh
ssh-add ~/.ssh/id_ed25519                    # load the key into the SSH agent
ssh -T git@github.com                        # test the connection

1. Protect the key with a passphrase when ssh-keygen asks.
2. Add the contents of the .pub file in your account settings on the Git host.
3. Use the SSH form of the remote URL, for example git@github.com:org/repo.git.

Windows 10 and later include the OpenSSH client. The ssh-agent service is disabled by default and has to be enabled once, in a PowerShell window started as administrator. After that, ssh-add works as a normal user:

Get-Service ssh-agent | Set-Service -StartupType Manual
Start-Service ssh-agent
ssh-add $env:USERPROFILE\.ssh\id_ed25519
ssh-add -l                                   # list loaded keys

Git Bash also works. A first ssh -T git@github.com asks you to confirm the host fingerprint; answering yes saves it. A successful test greets you by username.

HTTPS and tokens

With a URL such as https://github.com/org/repo.git, most hosts no longer accept your account password. You use a personal access token instead. The Git Credential Manager, installed with Git for Windows, signs you in through the browser and stores the token securely.

• Give tokens the smallest set of permissions they need, and an expiry date.
• Treat a token like a password. Never paste it into code, chat or a commit.

Troubleshooting

• Permission denied (publickey): the key is not loaded, not registered, or registered on a different account.
• Check the remote URL with git remote -v, and change it with git remote set-url origin <url>.
• A prompt for a password over HTTPS usually means the token or stored credential has expired.
• A stale or wrong stored credential (an old token, or the wrong account) is reused silently until you remove it. git config --get credential.helper shows which helper stores it; on Windows it is normally manager. Remove the entry, for example git:https://github.com, under Credential Manager, Windows Credentials in Control Panel, or in Git Bash run printf "protocol=https\nhost=github.com\n\n" | git credential reject. The next git push or git fetch asks you to sign in again.

Try it

Generate a key, register it with your Git host, and clone a repository over SSH. Then run git remote -v and compare the SSH and HTTPS forms of the URL.