Git push with username and password still works, but requires a personal access token instead of your actual password

When you run git push, Git needs to know who you are before it sends your code to the remote repository. If you want to authenticate with a username rather than an SSH key, you will use your username paired with a personal access token — not your account password. GitHub, GitLab, and Bitbucket all stopped accepting raw passwords for security reasons, so the token is now the standard way to push code this way.

The process has three parts: create the token in your Git hosting account, tell Git to store it so you do not type it every time, and then push normally. The token acts like a password but with an expiration date and limited permissions, so if it leaks, you can revoke it without changing your actual account password.

Key Takeaways

  • GitHub, GitLab, and Bitbucket require a personal access token instead of your account password when pushing with a username.
  • You create the token once in your account settings, then store it locally so Git remembers it for future pushes.
  • The token should be treated like a password — keep it private and revoke it if you think it has been exposed.
  • Once stored, you push the same way you always do: git push will use your saved credentials automatically.

Creating a personal access token on GitHub

Go to your GitHub account settings and find the Developer settings menu on the left sidebar. Click Personal access tokens, then Tokens (classic). Click Generate new token and choose Generate new token (classic) — this is the simpler option for basic push operations.

Give the token a name you will recognize, like "My laptop" or "Work machine". Set an expiration date — 30 days is common for security, though you can choose 90 days or no expiration if you prefer. Under Scopes, check the box for repo (which includes read and write access to repositories). Click Generate token at the bottom. GitHub will show the token once — copy it when ready and save it somewhere safe, because you cannot view it again after you leave the page.

Creating a personal access token on GitLab

Log in to GitLab and click your profile icon in the top right corner. Select Preferences, then Access Tokens on the left menu. Click Create personal access token. Give it a name, set an expiration date, and under Scopes check api and read_repository and write_repository. Click Create personal access token. Copy the token when ready — like GitHub, you will not see it again.

Store the token in a safe place on your computer, such as a password manager or a locked notes file. You will need it in the next step when you configure Git to use it for authentication.

Creating a personal access token on Bitbucket

Click your profile icon in the bottom left corner and select Personal settings. Go to App passwords under Access management. Click Create app password. Give it a label and under Permissions check repository:write. Click Create. Copy the password that appears — this is your token.

Like the other platforms, Bitbucket shows the token only once, so save it when ready before navigating away from the page. You will use this token in the credential storage step that follows.

Storing your token so Git remembers it

Once you have the token, you need to tell Git to save it so you do not have to paste it every time you push. The easiest way is to use Git's credential helper, which stores the token on your machine. On Windows, this is built in. On Mac and Linux, you may need to set it up first.

Open your terminal or command prompt and run this command:

git config --global credential.helper store

This tells Git to remember your credentials in a file on your computer. The next time you push, Git will ask for your username and password. Enter your username (usually your GitHub/GitLab/Bitbucket username) and paste the token when it asks for the password. Git will save both and use them for all future pushes to that host.

If you want to be more cautious, use git config --global credential.helper cache instead. This stores the token in memory for 15 minutes, then forgets it — you will have to paste it again after that time passes, but it is never written to disk.

Pushing code after you have stored your token

Once your token is stored, pushing works exactly as it always does. Navigate to your repository folder in the terminal and run:

git push origin main

Replace main with whatever branch you are pushing to. Git will use your stored username and token automatically — you will not see a prompt unless the credentials have expired or been revoked. If you get an error saying authentication failed, your token may have expired or been deleted from your account settings.

The first time you push after storing credentials, Git may pause for a moment while it verifies them. After that, subsequent pushes will be faster because Git already knows who you are.

Updating or revoking a token

Tokens expire on the date you set when you created them. When yours expires, you will get an authentication error on your next push. Go back to your account settings, create a new token following the same steps as before, and store it using git config --global credential.helper store again. Git will overwrite the old one.

If you think your token has been exposed or you no longer use a machine, revoke it when ready in your account settings. On GitHub, go to Developer settings > Personal access tokens > Tokens (classic), find the token, and click Delete. On GitLab, go to Access Tokens and click Revoke next to the token. On Bitbucket, go to App passwords and click Delete. Revoking stops anyone else from using it to push code to your repositories.

Frequently Asked Questions

Can I use my actual GitHub/GitLab/Bitbucket password instead of a token?

No. GitHub removed password authentication in 2021, and GitLab and Bitbucket followed. All three platforms now require a personal access token. If you try to use your account password, you will get an authentication error.

What happens if I forget to copy my token before leaving the page?

You cannot retrieve it. Create a new token instead — go back to your account settings and generate another one. You can have multiple tokens at once, so the old one straightforward becomes unused. Delete it from your settings if you want to clean up.

Is it safe to store my token on my computer?

It is reasonably safe if your computer is not shared and you keep your operating system updated. The token is stored in a plain text file, so anyone with access to your machine could read it. If you share your computer, use the cache helper instead so the token is only held in memory. If you use a public or work machine, do not store it at all — paste the token each time you push.

My push still fails even though I stored my token correctly. What should I check?

First, verify the token has not expired by checking your account settings. Second, make sure you are pushing to the correct remote — run git remote -v to see which URL Git is using. Third, confirm you have write permission to the repository. If the repository is owned by someone else, they may not have given you push access.

Can I use the same token on multiple machines?

Yes, but it is not recommended. If one machine is compromised, the attacker has access to all your repositories. Create a separate token for each machine instead — it takes 30 seconds and gives you the ability to revoke access to one machine without affecting the others.