Setting Up an SSH Key for Github

How It Started

I use GitKraken as my Git client, but sometimes I can’t be bothered to launch the app, so I type Git commands in the CLI and push from there. And whenever I push to Github that way, I keep running into the same error. Here it is.

That Password authentication is not supported for Git operations. error. Since August 2021, Github has officially stopped supporting push, clone, and pull with a username and password.

(Nooo!!!)

Honestly, I don’t use Github much. I mostly use a private Git server, so I keep forgetting this. I kept telling myself I’d write it down someday, and only now have I finally gotten around to it (five years have gone by!).

I’m on a Mac, but things aren’t much different on Windows. You can learn how to create a key in my earlier post, Connecting to a Host with a Key Made by SSH Keygen, so I’ll skip that part here.

From here on, I’ll pick up the story after the key has been created. As you can see in the image above, the SSH key is ready. Now let’s register it with Github.

Registering the SSH Key with Github

Once you log in to Github, you’ll see your profile picture in the top right corner. Click it and you’ll find the Settings menu.

Inside Settings, you’ll see a menu called SSH and GPG keys in the side menu.

Open the SSH and GPG keys menu and you’ll see a list of the SSH keys registered so far (it’s empty if you haven’t registered any) and a button labeled New SSH key. Click the New SSH key button.

This brings up a screen where you can enter the SSH key you made earlier. The important thing here is to paste the contents of the file with the .pub extension. The public key, I mean. Never, ever paste anything that says PRIVATE KEY. Never! Ever!

Enter the key and click the Add SSH key button, and that’s it for registering your SSH key with Github.

Now let’s push some code to Github with the SSH key I made.

Checking That the SSH Key Works

You can check that your SSH key works with the command below.

ssh -i ~/.ssh/{the key you just made} -T git@github.com

Type that in and you’ll see. I created my key with the name github-ed25519, and as shown below, the key worked fine.

But if you look at the response, it says but Github does not provide shell access.. This is no big deal. We tried to open an SSH terminal session on Github, and since we’re not supposed to (and can’t) get a terminal on Github’s servers, it shows this message. If you see the Hi {username}! You've successfully authenticated response, you can consider it a success.

Applying the SSH Key to a Repository

There are several ways to make Git use your SSH key. Let’s go over them one by one.

Specifying It for a Single Command (Global Setting)

The simplest way is to put the key you want in the GIT_SSH_COMMAND environment variable and put it in front of the Git command. That way, the key is used only when that command runs.

GIT_SSH_COMMAND="ssh -i ~/.ssh/github-ed25519 -o IdentitiesOnly=yes" git push origin main

Make sure you include IdentitiesOnly=yes here. Without this option, SSH first tries the other keys registered in ssh-agent, which can leave you authenticated as the wrong account, or kicked out with Too many authentication failures after too many attempts.

If typing all that every time is a pain, just put it in your shell config file (something like ~/.zshrc). Then every repository will use this key.

export GIT_SSH_COMMAND="ssh -i ~/.ssh/github-ed25519 -o IdentitiesOnly=yes"

The catch is that the same key will also be used in places that need a different key, like a private Git server. If you use other Git servers besides Github like I do, the per-repository setting below is the better choice.

$env:GIT_SSH_COMMAND = "ssh -i ~/.ssh/github-ed25519 -o IdentitiesOnly=yes"
git push origin main

set "GIT_SSH_COMMAND=ssh -i ~/.ssh/github-ed25519 -o IdentitiesOnly=yes"
git push origin main

setx GIT_SSH_COMMAND "ssh -i ~/.ssh/github-ed25519 -o IdentitiesOnly=yes"

Specifying It for One Repository Only (git config Setting)

If you use a different key for each repository, use the core.sshCommand setting. Run the command below once inside the repository folder, and from then on a plain git push will use the key you specified.

git config core.sshCommand "ssh -i ~/.ssh/github-ed25519 -o IdentitiesOnly=yes"
git push origin main

This setting is saved only in that repository’s .git/config file, so it doesn’t affect other repositories or your private Git server. If you open .git/config, you’ll see it in there like this.

[core]
  sshCommand = ssh -i ~/.ssh/github-ed25519 -o IdentitiesOnly=yes

If you haven’t cloned the repository yet, you can set it while cloning. A setting passed with the -c option is used for the clone itself and also saved as-is in the cloned repository’s .git/config.

git clone -c core.sshCommand="ssh -i ~/.ssh/github-ed25519 -o IdentitiesOnly=yes" git@github.com:{username}/{repository}.git

To check that the setting went in, or to remove it, use the commands below.

# Check the current value
git config --get core.sshCommand

# Remove the setting
git config --unset core.sshCommand

These commands work the same in PowerShell and CMD on Windows. Just remember, as mentioned earlier, to write the key path with forward slashes instead of backslashes.

Let’s Push

I registered the key for the repository only and tried to push. But because I had set the remote to an https URL earlier, it asked me to enter a Username. I checked where the remote was pointing with git remote -v and changed it to the SSH URL with git remote set-url. After that, the push went through just fine.

Wrapping Up

I’d been meaning to write up how to set up an SSH key for Github someday, and I’ve finally done it. It feels like having a sore tooth pulled. Registering an SSH key is a real hassle, but it’s the right way to go for security. If it were a Git server only I used, maybe, but if you authenticate with a username and password to repositories on Github, which people all over the world use, someone could even spread malware across the world. So I think it’s worth us generous folks putting in a little extra effort to be part of a safer internet.

Bye!