This article explains what to type for the user name and the password when you clone a private AngusGit repository over HTTPS. After reading it, you can create a read-only access token that works only for the current repository, finish the clone with it, and save that token on your computer or in CI without writing it into the clone URL.
An access token is a secret you create for Git over HTTPS. You paste it where Git asks for a password. It can clone and, if you grant write, push. It cannot sign you in to the console.
The example is the real private repository on the AngusGit online instance, https://git.anguskit.com/anguskit/AngusKit.git. When you follow along, use your own repository address. To use an SSH key, or to push into an empty repository for the first time, see the first-push article linked at the end.
1. What to type for the user name and the password
| What the terminal asks | What to type | Notes |
|---|---|---|
Username for 'https://git.anguskit.com': |
Your AngusGit login name | Not the team name, and not the repository owner. In the example the owner is the team anguskit. The user name is still your own login name |
Password for 'https://<login>@git.anguskit.com': |
An access token | A login password also works. A token is safer, for the reasons below |
Three reasons to use a token instead of the login password:
- A login password can sign in to the whole console. If it is stored in a credential cache or a script and then leaks, the other person can do much more than clone code. A token is only for Git clone and push. It cannot sign in to the console.
- A token can be limited to
git:readand to a few repositories. If it leaks, the other person can only read those repositories. - A token has an expiration time, and you can revoke one token on its own. Revoking one token does not change your login password or your other tokens.
2. Create a read-only token
- Open the token page
In the sidebar, open Settings → Profile. The page title is My Profile. Open the Access Tokens tab, and click Generate New Token.
- Name, lifetime, and confirm it is you
Token Name should say what it is for, for example "Laptop clone AngusKit", so you can recognize it in the list later. Expiration, and the permissions in the next step, cannot be changed after the token is generated, so choose them correctly the first time. Expiration can be 30 days, 60 days, 90 days, or 365 days. Under Password Verification, enter your current login password to confirm that you are the one doing this.
- Grant only what you need
Under Scopes, select git:read. The description is "Allow clone / fetch (git-upload-pack)". Under Repository access, choose Selected repositories, check anguskit/AngusKit in the list, and set the permission to READ. From then on this token can read only that one repository.
- Save it immediately
Click Generate Token. The page says "Please copy this token now. For security reasons, it will not be shown again." Click Copy, store it in your password manager, and click I have saved this token. After that the list shows the token name and not the token text. If you lose it, generate a new one.
If you will also push with this token later, select git:write under Scopes and set the repository permission to WRITE. The description of git:write is "Allow push (git-receive-pack); implies git:read". If you set WRITE and do not select git:write, the page says "git:write scope is required when any repository is granted WRITE".
3. Clone
git clone https://git.anguskit.com/anguskit/AngusKit.git
The terminal first prints Cloning into 'AngusKit'..., then two prompts:
Username for 'https://git.anguskit.com':
Password for 'https://<login>@git.anguskit.com':
Type the login name at the first prompt. Paste the token you just saved at the second. Nothing appears on the screen while you paste. That is normal. Press Enter after you paste. When you then see Receiving objects progress, authentication has passed and the download is running. When the command finishes, the current directory has a new AngusKit folder. The clone is done.
4. Let Git remember the token
If you do not want to paste the token on every pull, let the system credential manager store it:
- macOS: Git uses Keychain by default. After the first entry, it is saved automatically.
- Windows: Git for Windows includes a credential manager. After the first entry, it is saved automatically.
- Linux: the line below keeps the credential in memory for a while (15 minutes by default) and does not write it to disk:
git config --global credential.helper cache
You can also use credential.helper store to keep it longer. That writes the token in plain text into ~/.git-credentials, so it fits a computer that only you use.
5. Clone in a script or in CI
A CI machine has nobody there to type a password. A common pattern is to put the token in the address, for example https://<login>:<token>@git.anguskit.com/.... That address is written into the cloned .git/config, and it can also show up in the build log.
Pass the token in a request header instead. Put the token in a CI secret variable, for example ANGUSGIT_TOKEN, then:
git -c http.extraHeader="Authorization: Bearer ${ANGUSGIT_TOKEN}" \
clone https://git.anguskit.com/anguskit/AngusKit.git
-c applies only to this command, so the token is not written into .git/config. Later, git fetch or git pull in this directory needs the same -c block.
Generate a separate token for CI. Put the pipeline name in the token name, grant only git:read under Scopes, and under Repository access select only the repository it needs to pull. If that pipeline has a problem, revoke this one token. Other people keep working.
6. When the token expires, or you need to replace it
On the Access Tokens list, each token shows a status (Active, Expired, or Revoked), Last used, Used followed by the use count, and Expires with the date.
After a token expires or is revoked, clone and pull with it fail authentication. Replace it in three steps:
- Generate a new token, as in section 2.
- Clear the old token Git has cached, or Git keeps trying the old one:
printf "protocol=https\nhost=git.anguskit.com\n\n" | git credential reject
- Run
git pullagain, and type the login name and the new token at the prompts.
If you suspect the token leaked, click Revoke on that token in the list. It stops working immediately. Revoke all makes every token of yours that has not expired stop at the same time. Scripts and CI that use those tokens stop as well. Before you click it, list the places that use them.
7. When the clone fails
| What you see | Why | What to do |
|---|---|---|
fatal: Authentication failed for 'https://git.anguskit.com/anguskit/AngusKit.git/' |
The token has expired or been revoked; characters were missing when you copied it; the user name is not the login name of the token's owner; this repository is not in the token's Selected repositories; or Git still has the old token cached | On the Access Tokens list, check this token's status and repository access. The user name is your own login name. If an old token was cached, run git credential reject from section 6 and try again |
fatal: could not read Username for 'https://git.anguskit.com': terminal prompts disabled |
You are cloning in an environment with no terminal prompt (CI or a script), and Git wants to ask for a user name and cannot | Pass the token with http.extraHeader, as in section 5 |
fatal: repository 'https://git.anguskit.com/anguskit/AngusKit.git/' not found |
The owner or the repository name in the address is wrong | Open the repository code page, click the green Code button, and copy the address again from the Clone panel |
| Clone works, and push is refused | The token's scope is only git:read, or the repository permission is only READ
|
A push needs git:write plus WRITE. Edit on a token can change only the name and the description. It cannot change the permissions, so generate another token for push |
Frequently asked questions
If I change the login password, do I have to replace the token?
No. A token and the login password are independent. After you change the password, the token still works until it expires.
Can an access token call the console API?
No. An access token is only for Git clone, fetch, and push over HTTPS. The console and its API still use the login session.
This computer needs two accounts to clone different repositories. What then?
Make credentials follow the full path. After git config --global credential.useHttpPath true, Git stores credentials separately for each repository's full address, so the two accounts' tokens do not overwrite each other.
I do not want to manage tokens. Is there another way?
Use SSH. Register a public key once under Settings → Profile, on the SSH Keys tab. After that, clone and push with the SSH address need no password and no token. The steps are in the first-push article linked at the end.
Summary
When you clone a private repository over HTTPS, the user name is your login name and the password is an access token. For a read-only case, generate a token that selects only git:read and only the target repository, and store it as soon as it is generated. For day-to-day use, let the system credential manager remember it. In CI, pass the token with http.extraHeader, and keep it out of the address. When a token expires, generate a new one and clear the old cache with git credential reject. If you suspect a leak, revoke that one token.
Conclusion: When you clone a private repository over HTTPS, the user name is your AngusGit login name, and the password is a
git:readtoken from Settings → Profile, on the Access Tokens tab. In CI, pass it withhttp.extraHeader, and keep the token out of the clone URL.
Top comments (0)