Clone a Private GitHub Repo in Sourcetree with a Token
When you clone a private GitHub repository in Sourcetree, your GitHub account password will not work.
The short answer: create a Personal Access Token on GitHub and paste that token into Sourcetree where the password would go.
GitHub stopped accepting password authentication for Git operations on 13 August 2021. Since then only an access token, OAuth, or an SSH key will authenticate. There is a second trap: Sourcetree’s OAuth integration only requests read access to public repositories, so connecting via OAuth leaves private repositories missing from the list.
This article covers the whole route, including that workaround.
Why does the GitHub password not work?
The short answer: GitHub removed account password authentication for Git operations on 13 August 2021. Four methods remain.
- Personal Access Token
- OAuth token
- SSH key
- GitHub App installation token
Follow an old tutorial and enter a password and you get Support for password authentication was removed on August 13, 2021. That error means the authentication method itself has to change, not the password.
Installing Sourcetree
The short answer: Sourcetree is a free Git client from Atlassian, available for macOS and Windows from the official site.
Download the current build for your OS from the Sourcetree site and run the installer.
You will be asked to sign in with an Atlassian account on first launch. If you only want to work with GitHub repositories you can skip that.
Creating an access token on GitHub
The short answer: make the token on GitHub first. You need a GitHub account to do it.
classic or fine-grained?
The short answer: fine-grained if you want to limit access to specific repositories, classic if you would rather not think about it.
| Item | classic | fine-grained |
|---|---|---|
| Permission model | Scopes, in broad units such as repo |
Per repository and per operation |
| Repositories covered | Everything the user can reach | Only the ones you select |
| Expiry | Can be set to never expire | 366 days maximum |
| How many you can hold | No limit | 50 per user |
| GitHub’s recommendation | — | This one |
Fine-grained limits the blast radius if a token leaks. For work repositories in particular, choose the one you can scope.
Generating the token
Start from your avatar in the top right of GitHub.
- Open Settings
- Open Developer settings at the bottom of the left menu
- Open Personal access tokens and pick the type
- Click Generate new token
- Set a name, an expiry, and the permissions
- Copy the token that appears
For classic, tick repo. Without it you cannot read or write private repositories. For fine-grained, select the repositories and set Contents to Read and write.
The token is shown once and never again. Copy it before leaving the page; if you lose it you have to issue a new one.
Adding the GitHub account to Sourcetree
The short answer: choose Basic as the authentication type, not OAuth.
OAuth hides your private repositories
The short answer: Sourcetree’s OAuth integration only asks GitHub for read access to public repositories.
Connect that way and private repositories never appear in the list, and you cannot write to them either. This is long-standing behaviour of the Sourcetree and GitHub integration.
For private repositories, Basic authentication with your username and the access token is the reliable route.
On macOS
Open Sourcetree, then Settings (Preferences in some versions), then the Accounts tab.
- Click Add
- Choose GitHub as the hosting service
- Choose Basic as the authentication type
- Enter your GitHub username
- Paste the access token into the password field
- Choose HTTPS as the protocol
On Windows
Open Tools, then Options, then the Authentication tab. Everything else is the same: Basic as the type, and the access token in the password field.
Cloning the private repository
The short answer: with the account registered, the clone itself is quick.
Copy the repository URL
Open the repository on GitHub and copy the HTTPS URL from the green Code button. Do not pick the SSH URL unless you have already set up an SSH key.
Clone in Sourcetree
Choose File, then Clone / New.
- Paste the URL into Source Path / URL
- Choose a local destination folder
- Click Clone
If authentication succeeds, the repository name and branch load automatically as soon as you paste. A red error at that point means authentication has not gone through yet.
What to check when it will not clone
The short answer: almost every failure is authentication, and each symptom points somewhere different.
| Symptom | Cause and fix |
|---|---|
| Password authentication error | You entered a password. Use the access token instead |
| Repository missing from the list | You connected via OAuth. Re-add with Basic and a token |
| Can read but cannot push | Token permissions. Tick repo for classic, or set Contents to Read and write for fine-grained |
| Authentication suddenly stops working | The token expired. Reissue on GitHub and register it again |
| Old credentials keep being used | Delete the GitHub entry in Keychain Access on macOS and restart Sourcetree |
The most common of these is an expired token you had forgotten about. Fine-grained tokens last at most 366 days, so they will always expire eventually.
Using an SSH key instead
The short answer: if you would rather not manage token expiry, authenticate with an SSH key. Register the key once and it does not expire, and it covers multiple repositories.
Generate a key pair locally, add the public key under Settings, then SSH and GPG keys on GitHub, and choose SSH as the protocol for the account in Sourcetree. Use the SSH clone URL rather than the HTTPS one.
If you need to convert between key file formats, converting pem and ppk on a Mac with PuTTYgen covers that.
The same approach connects Sourcetree to hosts other than GitHub. For Git inside AWS, see why AWS CodeCommit is closed to new users and what to use instead.
