The gh command asks for authentication even though gh auth login was successfully used, and the machine is already authenticated.

Issue

In the example below, we authenticated with the git gh command:

$ gh auth login
? What account do you want to log into? GitHub.com
- Logging into github.com
? You're already logged into github.com as user. Do you want to re-authenticate? Yes
? How do you want to authenticate? Paste an authentication token

Tip: you can generate a Personal Access Token here https://github.com/settings/tokens
The minimum required scopes are 'repo' and 'read:org'.
? Paste your authentication token: ********************************
- gh config set -h github.com git_protocol https
✓ Configured git protocol
✓ Logged in as user

Now, when trying to clone the repo, it throws a fatal: Authentication failed after asking for credentials.

[email protected]:/var/www/html# gh repo clone user/repo

Output:

Cloning into 'repo'...
Username for 'https://github.com': user
Password for 'https://[email protected]':
remote: Support for password authentication was removed on August 13, 2021.
remote: Please see https://docs.github.com/en/get-started/getting-started-with-git/about-remote-repositories#cloning-with-https-urls for information on currently recommended modes of authentication.
fatal: Authentication failed for 'https://github.com/user/repo.git/'
exit status 128

[email protected]:/var/www/html# gh auth logout
? Are you sure you want to log out of github.com account 'user'? No

[email protected]:/var/www/html# gh repo clone user/repo
Cloning into 'repo'...
Username for 'https://github.com': q
Password for 'https://[email protected]':
remote: Support for password authentication was removed on August 13, 2021.
remote: Please see https://docs.github.com/en/get-started/getting-started-with-git/about-remote-repositories#cloning-with-https-urls for information on currently recommended modes of authentication.
fatal: Authentication failed for 'https://github.com/user/repo.git/'
exit status 128

[email protected]:/var/www/html# gh config set git_protocol ssh -h github.com

[email protected]:/var/www/html# gh repo clone user/repo
Cloning into 'repo'...
The authenticity of host 'github.com (120.12.121.4)' can't be established.
ED25519 key fingerprint is SHA256:+sdfsdfsdfsdfsdfsdvcxvxcv/afds.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'github.com' (ED25519) to the list of known hosts.
[email protected]: Permission denied (publickey).
fatal: Could not read from remote repository.

Cause & Fix

The error occurs because the authentication for the GitHub API and git traffic to GitHub can use separate methods, and they are not always automatically configured together. When you authenticate with the GitHub CLI (e.g., through the gh auth login command), you are authenticating with the GitHub API. However, this doesn’t guarantee that your git traffic to GitHub is also authenticated.

This separation in authentication methods can cause confusion and lead to errors when users try to perform git operations on GitHub repositories. For example, a user might have successfully authenticated with the GitHub API using the CLI, but git operations like cloning, pushing, or pulling might still fail if the git authentication is not properly configured.

To resolve this issue, users can either choose to authenticate git with their GitHub credentials during the gh auth login process or manually configure git authentication using the following commands:

git config --global 'credential.https://github.com.helper' ''
git config --global --add 'credential.https://github.com.helper' '!gh auth git-credential'