SSH Permission Denied (Publickey) on GitHub: Complete Troubleshooting Guide

Seeing Permission denied (publickey) when connecting to GitHub means GitHub could not authenticate your SSH connection with any key your computer offered. The usual causes are an unloaded key, an incorrect remote URL, a key attached to another GitHub account, or an SSH configuration problem.

This guide checks each cause in the fastest order so you can get git clone, git pull, and git push working again.

What Does Permission denied (publickey) Mean?

For an SSH remote such as git@github.com:owner/repository.git, GitHub expects your SSH client to present a private key whose matching public key is saved in the correct GitHub account.

The authentication process is:

1. Git connects to github.com.
2. SSH looks for a usable private key.
3. GitHub matches the public key to an account.
4. GitHub checks that account's repository access.

The error means one of the first three steps failed. It does not usually mean your Git installation or repository files are damaged.

Step 1: Confirm That the Repository Uses SSH

From inside your local repository, run:

git remote -v

An SSH remote looks like this:

git@github.com:username/repository.git

If the URL starts with https://github.com/, Git is using HTTPS instead. Change it to the SSH URL shown by the repository's Code button:

git remote set-url origin git@github.com:username/repository.git
git remote -v

tip

To automatically convert GitHub HTTPS URLs to SSH, run:

git config --global url."git@github.com:".insteadOf "https://github.com/"

Step 2: Test SSH Authentication Directly

Test the SSH connection without Git:

ssh -T git@github.com

A successful response looks like this:

Hi your-username! You've successfully authenticated, but GitHub does not provide shell access.

The “does not provide shell access” message is expected. GitHub supports SSH for Git operations, but not for an interactive shell.

If you still receive Permission denied (publickey), continue below.

Step 3: Check Whether an SSH Key Exists

List your SSH files:

ls -al ~/.ssh

Look for a pair such as id_ed25519 and id_ed25519.pub, or id_rsa and id_rsa.pub. The file without .pub is the private key; never share it. The .pub file is the public key that can be added to GitHub.

If you do not have a key, create an Ed25519 key:

ssh-keygen -t ed25519 -C "your_email@example.com"

Display the public key so you can copy it:

cat ~/.ssh/id_ed25519.pub

Add the complete line to GitHub → Settings → SSH and GPG keys → New SSH key. Select Authentication Key.

Step 4: Start the SSH Agent and Load Your Key

Start the agent in your current terminal session:

eval "$(ssh-agent -s)"

Check which keys are loaded:

ssh-add -l

If you see The agent has no identities, load your key:

ssh-add ~/.ssh/id_ed25519

Test again:

ssh -T git@github.com

Windows PowerShell

Open PowerShell as an administrator if the OpenSSH agent service is stopped:

Get-Service ssh-agent | Set-Service -StartupType Automatic
Start-Service ssh-agent
ssh-add $env:USERPROFILE\.ssh\id_ed25519

macOS

Store the key in the macOS Keychain with:

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

You can also add this to ~/.ssh/config:

Host github.com
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/id_ed25519

Step 5: Verify the Key Belongs to the Correct GitHub Account

A key may be valid but attached to the wrong GitHub account. Compare your local public key with the key listed under GitHub → Settings → SSH and GPG keys:

cat ~/.ssh/id_ed25519.pub
ssh-keygen -lf ~/.ssh/id_ed25519.pub

Confirm that:

• The complete public key is present in GitHub.
• It is an Authentication Key.
• It belongs to the account that should access the repository.
• It has not been deleted or revoked.

warning

Never upload ~/.ssh/id_ed25519, your private key, to GitHub. Only upload the file ending in .pub.

Step 6: Debug with Verbose SSH Output

If the problem continues, run:

ssh -vT git@github.com

For maximum detail:

ssh -vvvT git@github.com

Look for lines such as:

Offering public key: /home/user/.ssh/id_ed25519

If no key is offered, SSH is not selecting your identity. If the key is offered but rejected, check that its public key is registered with the correct GitHub account.

To see the effective SSH configuration, run:

ssh -G git@github.com | grep -E "identityfile|user|hostname"

Step 7: Configure the Correct Key Explicitly

When several keys are installed, SSH may select the wrong one. Edit ~/.ssh/config:

Host github.com
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_ed25519
  IdentitiesOnly yes

IdentitiesOnly yes tells SSH to use the configured key rather than trying every key in the agent.

Set safe permissions:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/config
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub

Then test:

ssh -T git@github.com

Step 8: Fix Multiple GitHub Accounts

GitHub does not allow the same SSH key to be attached to multiple accounts. Create separate keys for personal and work accounts:

ssh-keygen -t ed25519 -C "personal@example.com" -f ~/.ssh/id_ed25519_personal
ssh-keygen -t ed25519 -C "work@example.com" -f ~/.ssh/id_ed25519_work

Add each public key to its matching account, then configure host aliases:

Host github-personal
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_ed25519_personal
  IdentitiesOnly yes

Host github-work
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_ed25519_work
  IdentitiesOnly yes

Use the matching alias in a repository remote:

git remote set-url origin git@github-work:company/repository.git
ssh -T git@github-work

Step 9: Check Repository Access

If ssh -T git@github.com succeeds but cloning or pushing fails, SSH authentication works. Check the repository URL and permissions:

• Confirm the owner and repository name are spelled correctly.
• Confirm the repository still exists and was not transferred.
• Confirm your account or team has access.
• If the organization uses SAML SSO, authorize your SSH key for that organization.

Test read access without cloning:

git ls-remote git@github.com:owner/repository.git

If this prints HEAD and references such as refs/heads/main, your account can read the repository.

Common Causes and Quick Fixes

Symptom	Likely cause	Fix
Permission denied (publickey) from ssh -T	Key is missing, unloaded, or not registered	Run ssh-add, then add the matching .pub key to GitHub
git remote -v shows https://	Repository is not using SSH	Run git remote set-url origin git@github.com:owner/repository.git
Authentication succeeds as the wrong account	Wrong key selected	Use an SSH host alias and IdentitiesOnly yes
Repository not found after authentication succeeds	Wrong URL or missing repository access	Check the repository path and account permissions
Too many authentication failures	Agent offers too many keys	Configure IdentitiesOnly yes
Works in one terminal but not another	Different agent environments	Start the agent and load the key in the affected session
Works with sudo but not as your user	Root and your user use different SSH settings	Avoid sudo git; configure SSH for your normal user

Quick Diagnostic Checklist

Run these commands in order:

# Check the Git remote
git remote -v

# Check loaded keys
ssh-add -l

# Load the key if necessary
ssh-add ~/.ssh/id_ed25519

# Test GitHub authentication
ssh -T git@github.com

# Test repository access
git ls-remote git@github.com:owner/repository.git

If step 4 succeeds but step 5 fails, focus on repository permissions, the URL, or organization SSO. If step 4 fails, focus on the SSH key, agent, and configuration.

Frequently Asked Questions

Why does GitHub say it authenticated me but does not provide shell access?

That is the normal GitHub response. SSH is used for clone, fetch, and push, but GitHub does not provide an interactive shell.

Can I reuse one SSH key on multiple computers?

You can, but a separate key per computer is safer. If one device is lost or compromised, you can revoke only that device's key.

Should I use RSA or Ed25519?

Use Ed25519 for new keys unless you need to support an older system that does not support it.

Why does git push still ask for a password?

Your remote probably uses HTTPS. Run git remote -v and change an https:// URL to the SSH URL with git remote set-url.

Is the SSH username my GitHub username?

No. The SSH username is always git. GitHub identifies your account from the SSH key, so the URL begins with git@github.com:.

Conclusion

To fix GitHub's Permission denied (publickey) error, verify the remote URL, load the correct private key into the SSH agent, test with ssh -T git@github.com, and confirm that the matching public key belongs to the right GitHub account.

For multiple accounts, use separate keys and SSH host aliases. Once direct authentication succeeds, git ls-remote helps distinguish repository permissions from local SSH configuration problems.

For official reference, see GitHub's SSH connection troubleshooting guide and adding a new SSH key.