Git "remote: Invalid username or password" in CI

By Kaveh Alemi·Latchkey

The host rejected the HTTPS credential as invalid. The connection reached the server, but the username/password (or token) pair was wrong, empty, or used a password where a token is required.

What this error means

A clone/fetch/push over HTTPS fails with remote: Invalid username or password followed by fatal: Authentication failed. It is deterministic - the same credential fails every time until corrected.

git output

remote: Invalid username or password.
fatal: Authentication failed for 'https://github.com/org/repo.git/'

Common causes

A password supplied where a token is required

GitHub does not accept account passwords for Git over HTTPS. A password in the helper or URL is rejected as invalid.

Empty or malformed credential

A secret that resolved to empty (unset variable, wrong secret name) sends a blank username/password the server rejects.

Mismatched username/token pair

An installation token must pair with the username x-access-token; a PAT pairs with your username. The wrong username with the token reads as invalid.

How to fix it

Use the correct username/token pairing

Pair an installation token with x-access-token, or a PAT with your username.

Terminal

# installation/App token:
git clone https://x-access-token:${GITHUB_TOKEN}@github.com/org/repo.git
# personal access token:
git clone https://USERNAME:${PAT}@github.com/org/repo.git

Confirm the secret actually resolved

Verify the secret/env name is correct and non-empty (a typo yields an empty credential).
Ensure the token has not expired or been revoked.
Re-store a freshly generated token in the CI secret if in doubt.

How to prevent it

Never use account passwords for Git automation - use tokens or SSH.
Pair installation tokens with x-access-token and PATs with your username.
Guard against empty secrets by asserting the credential is set before use.

Frequently asked questions

What causes ""Invalid username or password""?