WardtermSSH client
EN
Download

"git@github.com: Permission denied (publickey)": how to fix it

GitHub did not accept any key your SSH client offered. Run ssh -vT git@github.com to see which keys are offered. Then make sure the key is the one added to your GitHub account, is loaded or named in ~/.ssh/config, and that you connect as the user git. Do not use sudo git, which looks for root's keys. The same checks work for GitLab with ssh -T git@gitlab.com.

Updated . The Git error text, ssh -G, core.sshCommand and git remote commands were run with OpenSSH 10.3 and Git on macOS against a local test server with a throwaway key.

What you see

git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

The first line is the real error, and it comes from SSH. Git's lines appear for many other failures too, so do not let them send you looking at the repository.

Test SSH without Git

ssh -T git@github.com

When the key is accepted, GitHub greets you and closes the connection. The exit status is 1 even then, because GitHub offers no shell:

Hi username! You've successfully authenticated, but GitHub does not provide shell access.
  • You get Permission denied (publickey): follow the causes below.
  • You get the greeting with a different name than expected: SSH is using a key from another account. See cause 3.
  • You get the greeting with the right name but Git fails with Repository not found: your account has no access to that repository, or the URL is wrong.

Cause 1: no key, or the wrong key, is offered

ssh -vT git@github.com 2>&1 | grep -E 'identity file|Offering|Authentications'

A line ending in type -1 means SSH found no such file. SSH looks for default names such as ~/.ssh/id_ed25519 and ~/.ssh/id_rsa. Without any Offering public key line, nothing was tried. See what is available:

ls -l ~/.ssh/
ssh-add -l

If your key has another file name, tell SSH in ~/.ssh/config:

Host github.com
  User git
  IdentityFile ~/.ssh/id_ed25519_github
  IdentitiesOnly yes

Check the result without connecting:

ssh -G github.com | grep -E '^(user|identityfile|identitiesonly) '

If you have no key at all, follow how to add an SSH key to GitHub.

Cause 2: the public key is not on your account

Compare fingerprints, not the look of the key:

ssh-keygen -lf ~/.ssh/id_ed25519.pub

Then open GitHub, Settings, SSH and GPG keys, and look for the same SHA256: value. If it is missing, add the contents of the .pub file. Never paste the private key. A key used as a deploy key on one repository cannot also be added to an account.

Cause 3: the wrong account

With a work and a personal account, the first key that GitHub recognizes wins, even if it belongs to the other account. IdentitiesOnly yes as shown above limits SSH to the key you name. To use two accounts side by side, see multiple GitHub accounts.

For one repository only, you can set a key directly:

git config core.sshCommand "ssh -i ~/.ssh/id_ed25519_work -o IdentitiesOnly=yes"

Cause 4: the wrong user in the URL

The user is always git, not your GitHub name:

git remote -v

A correct SSH remote starts with git@github.com:. If yours has another user name, set it again:

git remote set-url origin git@github.com:owner/repo.git

Cause 5: sudo

sudo git pull runs as root, so SSH looks in /root/.ssh, and your agent is usually out of reach. Fix the ownership of the folder instead, and run Git as yourself:

sudo chown -R "$USER" /path/to/repo

Cause 6: the key is not loaded

A key with a passphrase, used by a GUI app or a script with no way to ask, fails as if it were missing. Load it:

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

If that prints an error, see Could not open a connection to your authentication agent.

On a Mac, the agent forgets the key after a restart. Save the passphrase in the Keychain once:

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

Then add these two lines to the Host github.com block of ~/.ssh/config, so SSH loads the key by itself:

  AddKeysToAgent yes
  UseKeychain yes

Other things to try

  • Key permissions: if the output mentions UNPROTECTED PRIVATE KEY FILE, see this fix.
  • Many keys in the agent: see Too many authentication failures.
  • In CI: use a deploy key or a token from your CI system. Personal keys do not belong there.
  • For a quick way forward, HTTPS with a token avoids SSH altogether: git remote set-url origin https://github.com/owner/repo.git.
  • Git on a remote server: forward your key with the agent instead of copying it there, after reading the risks of SSH agent forwarding.

Questions

Why does Git say Could not read from remote repository?

It is Git's generic line after SSH failed. The real cause is the line above it, here Permission denied (publickey): GitHub did not accept any key SSH offered.

How do I see which key SSH sends to GitHub?

Run ssh -vT git@github.com and read the Offering public key lines. ssh-add -l lists the keys loaded in the agent.

Why does git pull fail only with sudo?

sudo runs as root, so SSH reads /root/.ssh and usually cannot reach your agent. Run Git as your own user and fix the folder ownership instead.

Sources

More in Error messages

All guides