GitHub Authentication Using PAT and SSH

What is GitHub Authentication?

When your local Git communicates with GitHub, GitHub needs to verify who you are and whether you have permission to access the repository.

Authentication is required for operations such as:

git clone
git fetch
git pull
git push

especially when accessing private repositories or performing write operations.

Two common authentication methods are:

1. HTTPS with a Personal Access Token (PAT)
2. SSH keys

Local Git
    |
    | Authentication
    |
    +---- HTTPS + PAT
    |
    └---- SSH Key
              ↓
            GitHub

Your normal GitHub account password is not used as a Git password for HTTPS Git operations. With HTTPS, a token or credential-manager-based GitHub authentication is used.

1. Authentication Using PAT

What is a PAT?

A Personal Access Token (PAT) is a token generated in GitHub that can be used to authenticate Git operations over HTTPS.

Conceptually:

Username + PAT
      ↓
    HTTPS
      ↓
    GitHub

A PAT acts like a credential, so it must be protected.

Simple Example

Suppose the repository URL is:

https://github.com/myuser/myproject.git

Clone:

git clone https://github.com/myuser/myproject.git

When authentication is required, Git may obtain credentials through your configured credential helper. In a direct username/password-style prompt, the token is used in place of the password:

Username: myuser
Password: <PAT>

Then GitHub validates the token and its permissions.

Creating a PAT

In GitHub, PATs are managed from your account's developer settings.

GitHub supports token types including fine-grained personal access tokens and classic PATs. Fine-grained tokens allow tighter control over repository access and permissions.

For example, you can restrict a token to:

Repository:
myproject

Permissions:
Contents → Read and write

The exact permissions should be limited to what your workflow actually needs.

Using Git Credential Manager

You generally should not put the PAT directly inside the repository URL or store it in source code.

On Windows, Git Credential Manager can securely handle credentials for HTTPS Git operations.

For example:

git clone https://github.com/myuser/myproject.git

Git Credential Manager may open a GitHub authentication flow and then securely manage the resulting credential.

After authentication, normal commands remain:

git pull
git push

You don't need to manually type a token for every operation when credentials are properly managed.

PAT Flow

git push
    ↓
HTTPS remote
    ↓
Credential Manager / PAT
    ↓
GitHub authenticates user
    ↓
Checks repository permission
    ↓
Push allowed or rejected

Key Points

• PAT is used with HTTPS authentication.
• Treat a PAT like a password.
• Prefer the minimum required permissions.
• Fine-grained PATs provide more granular repository/permission control.
• Do not hard-code PATs into source code.
• Do not commit PATs to Git.
• A credential manager can make HTTPS authentication easier and safer.

2. Authentication Using SSH

What is SSH Authentication?

SSH authentication uses a public/private key pair instead of an HTTPS token.

You create:

Private Key
Public Key

The private key stays on your computer.

The public key is added to your GitHub account.

Your Computer                     GitHub
-------------                     ------

Private Key

Public Key ---------------------> Public Key
                                  registered
                                  with account

When connecting, GitHub verifies that you possess the private key corresponding to the registered public key.

Creating an SSH Key

A common modern choice is Ed25519:

ssh-keygen -t ed25519 -C "your-email@example.com"

Git asks where to save the key and optionally for a passphrase.

Typical files are:

~/.ssh/id_ed25519
~/.ssh/id_ed25519.pub

The files have different purposes:

id_ed25519
→ PRIVATE KEY

id_ed25519.pub
→ PUBLIC KEY

Never share the private key.

Add the Public Key to GitHub

Display the public key:

cat ~/.ssh/id_ed25519.pub

On Windows PowerShell, you can also use:

Get-Content ~/.ssh/id_ed25519.pub

Copy the public key and add it to your GitHub account's SSH keys.

Conceptually:

Public Key
    ↓
GitHub Account
    ↓
SSH Keys

Test SSH Authentication

Run:

ssh -T git@github.com

On the first connection, SSH may ask you to verify GitHub's host key.

After successful authentication, GitHub reports that authentication succeeded.

Clone Using SSH

Instead of an HTTPS URL:

https://github.com/myuser/myproject.git

use the SSH form:

git@github.com:myuser/myproject.git

For example:

git clone git@github.com:myuser/myproject.git

Then normal Git commands work:

git pull
git push

SSH performs authentication using your key.

SSH Authentication Flow

git push
    ↓
SSH connection
    ↓
GitHub presents authentication challenge
    ↓
Your SSH client proves possession
of the private key
    ↓
GitHub checks registered public key
    ↓
Identity verified
    ↓
Repository permissions checked
    ↓
Push allowed/rejected

The private key is not sent to GitHub.

PAT vs SSH

How to Check Which Method You Are Using

Run:

git remote -v

If you see:

https://github.com/myuser/myproject.git

you are using an HTTPS remote.

Authentication may be through PAT/Git Credential Manager.

If you see:

git@github.com:myuser/myproject.git

you are using SSH.

Change HTTPS Remote to SSH

Check the existing remote:

git remote -v

Change it:

git remote set-url origin git@github.com:myuser/myproject.git

Verify:

git remote -v

Now future Git operations against origin use SSH.

Key Points

• GitHub must authenticate you before allowing protected repository operations.
• Two common approaches are HTTPS credentials/PAT and SSH keys.
• PAT is associated with HTTPS-based Git access.
• SSH uses a public/private key pair.
• Never commit PATs or private SSH keys into your repository.
• Use the minimum permissions required for tokens.
• Protect SSH private keys, ideally with an appropriate passphrase.
• git remote -v helps identify whether your remote uses HTTPS or SSH.
• Authentication proves your identity; GitHub then separately checks whether that identity has permission to perform the requested operation.