GitHub: Some Git over HTTPS clones may temporarily ask for authentication
GitHub says some unauthenticated HTTPS clones and fetches of public repos may temporarily fail and require authentication during unusual traffic. SSH and pushes are unaffected.
Before you start: versions, package names and storage identifiers change over time. Check the commands against the official documentation for your setup before running them, especially anything that creates, deletes or overwrites data.
GitHub says some unauthenticated clones and fetches of public repositories over HTTPS may temporarily fail and ask for authentication during periods of unusual traffic. The change, posted to GitHub’s changelog on October 19, 2026, is a protection measure aimed at keeping github.com available, according to the company.
If your operation is affected, it will stop with a message saying authentication is required. You can authenticate and retry, or wait and retry without credentials once the temporary protection has been lifted.
GitHub says it applies the protection as narrowly as it can, using signals tied to anomalous traffic. Because legitimate and anomalous traffic can sometimes share those signals, ordinary unauthenticated operations may occasionally be caught too. The company stresses this is not a general authentication requirement for public repositories.
What still works without logging in
Several paths are explicitly unaffected, according to GitHub:
- Authenticated Git operations over HTTPS
- Git operations over SSH
- Pushes
- Unrelated GitHub web and API traffic
The protection applies to repositories on github.com across all plans.
What to do if your automated clones break
For more reliable automated clones and fetches, GitHub recommends configuring authentication. In GitHub Actions, that means using the built-in GITHUB_TOKEN. On other CI systems, the company prefers a GitHub App installation access token, though a personal access token can also be used.
Operations that cannot authenticate have no workaround beyond retrying after the temporary protection is lifted. Setup instructions are in GitHub’s documentation on authentication to GitHub and managing remote repositories.
Nothing needs to be installed or updated for this change. If a clone or fetch fails with an authentication message, retry with credentials or wait and try again later.
Related reading
Sources
- Some Git over HTTPS may temporarily require authentication — GitHub Changelog
Some links on this page may be affiliate links. If you buy through them we may earn a commission at no extra cost to you. See our affiliate disclosure.
