Git & GitHub Fundamentals · Module 08 of 12

GitHub repositories and authentication

Connect the Git transport model to GitHub using HTTPS or SSH while separating identity, authorization and credentials.

Learning objectives

By the end of this module, you should be able to:

Choose an HTTPS or SSH remote deliberately.
Explain why a GitHub password is not used for Git-over-HTTPS authentication.
Keep tokens and private keys out of repositories.

GitHub is a hosting and collaboration layer

GitHub stores Git repositories and adds pull requests, issues, reviews, permissions, rulesets, releases and automation. Git commands still exchange objects and references with a remote URL.

HTTPS and SSH are both supported

For HTTPS command-line authentication, GitHub uses secure methods such as a personal access token through a credential helper or GitHub CLI; password-based Git authentication has been removed. SSH uses an SSH key associated with the account.

Secrets do not belong in Git

Never commit a personal access token, private SSH key or credential file. Use Git Credential Manager, GitHub CLI, an SSH agent or an approved enterprise credential mechanism. Rotate exposed credentials immediately.

Worked examples

See the idea in practice.

Inspect remote transport

git remote -v
# HTTPS example: https://github.com/OWNER/REPO.git
# SSH example:   git@github.com:OWNER/REPO.git
# Optional GitHub CLI: gh auth status

The remote URL determines whether Git uses HTTPS or SSH transport.
user.email remains commit metadata and is not the network credential.

Hands-on lab

Lab — Practice remote URL hygiene safely

Goal: Use a local remote for transport mechanics, then inspect example GitHub URLs without storing any real credential.

Before you start

Git 2.23 or newer is recommended so the labs can use git switch and git restore.
Run labs in a disposable working directory; the included validator creates and removes its own temporary repository.

STEP 1

Create a disposable repository and remote

mkdir -p ~/gnu-git-labs/module08 && cd ~/gnu-git-labs/module08
git init --bare remote.git
git clone remote.git work
cd work
git switch -c main
git config user.name "GNU Learner"
git config user.email "learner@example.invalid"
printf "safe\n" > README.md
git add README.md && git commit -m "Add safe example"
git push -u origin main

STEP 2

Inspect the remote

git remote -v

STEP 3

Review GitHub URL forms without changing credentials

printf '%s\n' 'HTTPS: https://github.com/OWNER/REPO.git' 'SSH:   git@github.com:OWNER/REPO.git'

STEP 4

Optional on a learner-owned GitHub repository

# git remote set-url origin https://github.com/YOUR-ACCOUNT/YOUR-REPO.git
# or: git remote set-url origin git@github.com:YOUR-ACCOUNT/YOUR-REPO.git
# Authenticate with an approved PAT/credential helper, GitHub CLI, or SSH key

Verify

No credential appears in git remote -v.
The local transport exercise works without GitHub credentials.

Expected outcome

Learners understand URL choice and authentication boundaries before publishing to GitHub.

If it fails

Do not embed tokens in remote URLs or shell history.
If SSH is blocked by a network policy, use HTTPS with an approved credential helper.
If authentication fails, verify account/repository permission separately from commit identity.

Real-world connection

Enterprise repositories frequently enforce SSO, approved credential helpers and token scope policies; the transport concepts remain the same.

Avoid these traps

Common mistakes

Putting a PAT directly into a remote URL.
Assuming user.name/user.email grants repository access.
Sharing a private SSH key between learners.

Knowledge check

Can you explain it without looking back?

Open each answer only after you have tried to answer the question yourself.

1Does GitHub accept the account password for Git-over-HTTPS authentication?

No. Use supported token/credential-helper or GitHub CLI mechanisms, or use SSH.

2What determines HTTPS versus SSH transport?

The configured remote URL.

3Where should a personal access token be stored?

In an approved credential mechanism, never committed to the repository.