GitHub Clone with OAuth Access Token

Question

Inside a script I am trying to clone a GitHub repository with an OAuth token.

According to this tutorial:

https://github.com/blog/1270-easier-builds-and-deployments-using-git-over-https-and-oauth

I should be able to build a command for it like this:

git clone https://<token>@github.com/owner/repo.git

If I try this manually with a proper access token, it still asks for my password.

If I try it on the commandline I am simply getting a repository not found error.

The article is from 2012 and I cannot find any API documentation for this. So I am wondering if this still works.

Prescriptive

What is the difference between "If I try this manually" and "If I try it on the commandline"? – Fritzfritze

Please correct the URI-token syntax, see https://mcmap.net/q/13728/-using-gitlab-token-to-clone-without-authentication – Landward

@PeterKrauss Linking to an unrelated thread seems a bit uncalled for, especially if it's a "closed" topic – Cheng

Answer 1

I turned out to be a scope issue. I of course needed full repo scope since I was trying to clone a private repository.

It's a shame Github does not have some clearer error messages for these kind of things, but security wise I understand why.

For anyone trying to figure out what is wrong when trying out something like this, I would suggest to create a personal access token with full access to everything:

settings > developer settings > personal access tokens > generate new token

This way you can easily test if it is a scope issue by comparing your token with a personal access token that has access rights for everything.

Thanks for anyone who still took the time to read this.

Prescriptive

Mind that if you simply try to access the repo page through a browser you'll still face a 404-not found page. But cloning worked fine regardless in my case. – Scumble

I provided a scope of user repo to the authorization request, and when requesting an access token it always returns with scope= (empty scope). Why is that? – Sapers

It may seem that there is no way to avoid write access using a Github security token, which is kind of a security limitation for scripts and other integrations where just cloning a private repo is required :( – Dextroamphetamine

Answer 2

Just use the HTTPS address to clone with the key as the user, so:

git clone https://oauth2:[email protected]/username/repo.git

or

git clone https://username:[email protected]/username/repo.git

Degraded

You can also use github Personal Access Token with this command in place of OAuth Key. – Feoff

It used to work fine for me with classical personal access token, but as of 18th of October, GitHub released also fine-grained personal access token and it looks like for them, you have to use git clone https://oauth2:<oauth-key-goes-here>@github.com/username/repo.git – Lepley

Wow. I wonder how the heck this is supposed to work with package managers like composer where the repository info is configured in plain-text JSON. I can't believe that Github doesn't provide a way to pass the key discreetly i.e. through the COMPOSER_AUTH environment variable...kind of defeats the purpose of an organization service user use case. – Woods

The way with …username:token… worked for Gitlab as well! – Sonstrom

I can still use fine-grained PAT without oauth2: – Utmost

Answer 3

Just clone the repository with HTTP like so:

git clone https://github.com/myuser/myrepo.git

When prompted for Username, fill your username.

When prompted for Password, fill the token instead.

Amplify

It is not the answer, the problem is about use the token, see https://mcmap.net/q/13728/-using-gitlab-token-to-clone-without-authentication – Landward

you can use the token in the URL as [email protected]/username/repo.git – Degraded

well....worked for github too... Guess it is supposed to be used.. like more of a appPassword with every URL Thanks Anyway – Stinking

Worth to say you can use your personal token in place of password for any git command line action, not only clone – Stiffen

found a error => remote : repository not found – Carburize

Answer 4

Please try this.

git clone `https://oauth2:[email protected]/username/repo.git`

For example, git clone https://oauth2:[email protected]/gituser/testrepo.git

Quyenr

it's working. please check the url carefully. @github.com/gituser/testrepo.git – Quyenr

This is way better than manually writing the username and password! I can save a github access token variable and user a script with git clone https://oauth:[email protected]/user/repo.git or just add the token itself to a script. Underrated answer here. – Myasthenia

I get ` remote: Invalid username or password` when using an organization repo :( git clone https://oauth2:[email protected]/MyOrg/repo.git – Repel

@AKingscote, please check if your key is correct and not expired. – Quyenr

token starting with ghp seems not be a new fine grained token, ghp is for classic token, which is easy to use but some orga disable it for security concern. The new fine grained token starts with github_pat_ where I have pain to use it even for git clone – Aphrodisiac

Answer 5

Do whatever works for you from these two choices

In your terminal

$ git clone your_repo_url Username:your_token Password:

... there is no password

In your git client app

i.e. Sourcetree, GitKraken, and the GitHub client.

Enter your repo_url (obvsiously without the '$ git clone part')

Username:your_token Password:

... there is no password

OR i.e. in Sourcetree, open preferences and then go to advanced, enter the hostname (i.e. www.x.com) and userName (i.e. your_token)

👍

Headquarters

Using token as username worked for me on windows – Plague

I had to use my real username as username and token as a password, not username as of now, maybe I had initially some redundant space in it, or it takes a little while, while the token activation takes places – Aho

Answer 6

go to https://github.com/settings/tokens and generate a new token, remember to enable access to the repo, after that, you can do the following to clone the repo.

git clone https://<token>@github.com/owner/repo.git

Note: owner is your username if it's your repository else keep username of repository owner(one with all the rights of repo).

Romaine

remote : repository not found – Carburize

this works for me. i had a dialog for it and after closing it the only way was putting the token in the url. thanks – Auld

It used to work fine for me with classical personal access token, but as of 18th of October, GitHub released also fine-grained personal access token and it looks like for them, you have to use git clone https://oauth2:<token>@github.com/owner/repo.git – Lepley

Answer 7

For lazy folks like future me:

1. Generate your "Personal access tokens (classic)" from https://github.com/settings/tokens and copy it. (This will behave like password in next steps.)

2. Run the following git command. It signals git to store the credentials (which will come in step 3)

   git config --global credential.helper manager-core
   git config --global credential.helper store
   

3. In your first clone you will be asked username and password provide your password coming from item 1 above:

   git clone https://[email protected]/GithubUserName/repo-to-clone.git
   

For next git commands you should not be asked for credentials.

Osric

Note that manager-core should be, from Git 2.39+, manager (no longer manager-core). And your second git config --global credential.helper command would override your first command anyway. – Operable

I can not thank enough to past me. This answer was useful 4 times within the last one month only. (I set up 4 different cloud machines, and each time I came here to do this stuff. Thank you past me, I love you!) – Osric

Hey past me! You are the man. I mean it; YOU ARE THE MAN! 👍 – Osric

Answer 8

Just for those who still have problem "cloning a private repository with a readonly FG token: "remote: Write access to repository not granted."

The error message is a bit misleading. In my case the issue was with the configuration:

1. Create a readonly token (content: readonly)
2. Make sure the resource owner is properly set.
3. For organizations, you have to complete "personal-access-tokens-onboarding".
4. Clone the repository using https://oauth2:[email protected]/myuser/myrepo.git (note the username, as suggested by others, it's oauth2)

With all of the above, I managed to clone a private repository with a readonly token (and no, there was no write access 🙂)

Attired

Answer 9

As of Spring 2023, if you have your access token scopes set correctly, this is a one liner for cloning a repo (no need for any further interaction):

git clone https://ghp_foo_etc:[email protected]/bar/baz-phoenix.git

Where ghp_foo_etc is your access token. That's it! This is similar to how npm accesses code in private repos. Theres' no need to provide a user name.

I'm pretty certain its' always been so!

Decalogue

Why there's so many ways to do this? Optional oauth2:, and now token first. Is there any docs for this? – Utmost

Answer 10

In .net core you can do in this way when dealing with Azure DevOps Repo:

 public void CloneRepository()
        {
            var _gitURL = "URLofGitRemoteRepository";
            var _userName = "PersonalAccessToken";
            var _pswd = ""; //Keep it blank

            var co = new CloneOptions();
            co.CredentialsProvider = (_url, _user, _cred) => new UsernamePasswordCredentials { Username = _userName, Password = _pswd };

            Repository.Clone(_gitURL, filePath, co);
        }

Rapparee

Answer 11

For me none of the answers above worked. It turns out I had set an expiration of one month on my token so I had to recreate the token using the instructions here: https://www.shanebart.com/clone-repo-using-token/

Bluecoat

Answer 12

You need to include a username before the token. GitHub accepts any username. oauth2 works for both GitHub and GitLab.

git clone https://oauth2:[email protected]/owner/repo.git

However including credentials in https Git URL is considered bad practice because it risks inadvert credential exposure from config files and command history.

Also, it will break when the token expires. This is as short as two hours for hosts such as GitLab and BitBucket.

More secure and more reliable is to use a credential-generating helper such as Git Credential Manager (included in Git for Windows) or git-credential-oauth (included in several Linux distributions).

The first time you authenticate, the helper opens a browser window to the host. Subsequent authentication is non interactive.

These helpers refresh expired OAuth tokens as necessary.

Thyroxine