Authentication: SSH and HTTPS

Introduction

Pushing and pulling requires proving you own the account. SSH keys and HTTPS with Personal Access Tokens (PAT) are the two standard methods on GitHub, GitLab, and Gitee. This chapter sets up SSH, configures credential storage for HTTPS, and lists security habits so tokens never land in Git history.

Prerequisites

• Remote Repositories
• Terminal access on your machine
• Account on your Git hosting platform

SSH vs HTTPS

Pick one per machine—SSH is common for daily dev.

Generate an SSH Key

ssh-keygen -t ed25519 -C "your.email@example.com"

Press Enter for default path ~/.ssh/id_ed25519; optional passphrase adds extra security.

Code explanation:

• ed25519 is modern default—use -t rsa -b 4096 only if old server requires RSA

Start agent and add key (macOS/Linux):

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

Add Public Key to GitHub

Copy public key:

cat ~/.ssh/id_ed25519.pub

GitHub → Settings → SSH and GPG keys → New SSH key → paste → save.

Test:

ssh -T git@github.com

Success message:

Hi username! You've successfully authenticated...

Clone and Push with SSH

git clone git@github.com:username/repo.git
git push origin main

No password prompt when key is loaded.

HTTPS with Personal Access Token

GitHub disabled password auth for Git operations—use a PAT.

Create token:

1. Settings → Developer settings → Personal access tokens
2. Fine-grained or classic token with repo scope (adjust minimally)
3. Copy token once—it will not show again

Clone:

git clone https://github.com/username/repo.git

When prompted:

• Username: GitHub username
• Password: paste PAT (not account password)

Credential Helper

Avoid retyping PAT:

git config --global credential.helper store

Or on macOS:

git config --global credential.helper osxkeychain

Windows Git for Windows often sets manager automatically.

Code explanation:

• Helper saves credentials securely on disk or keychain—still protect your machine

Switch Remote URL

From HTTPS to SSH:

git remote set-url origin git@github.com:username/repo.git

Verify:

git remote -v

Multiple GitHub Accounts (Awareness)

Use different SSH keys and ~/.ssh/config:

Host github-work
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_ed25519_work

Clone as git@github-work:org/repo.git.

Gitee / GitLab

Same SSH pattern—upload id_ed25519.pub in account SSH settings. HTTPS uses platform-specific tokens with equivalent scopes.

Security Checklist

• Passphrase on SSH key for laptops
• PAT scoped to minimum permissions
• Rotate token if leaked
• Enable 2FA on hosting account
• .gitignore secrets; use .gitignore chapter patterns

FAQ

Permission denied (publickey)?

Agent not running, wrong key, or public key not uploaded—run ssh-add -l and retest ssh -T.

Token worked once then failed?

Expired or revoked token—generate new PAT.

Corporate proxy blocks SSH?

Use HTTPS URL + credential helper.

Shared CI machine?

Use deploy keys or CI secrets—not your personal PAT in repo files.

git@github.com vs https?

Same repo, different transport—choose based on auth preference.

Commit email vs login?

Git commit uses user.email from config—can differ from GitHub noreply email.