World map

 

BM

World 4: Hello GitHub

Sign in with HTTPS and tokens

You will learn: how Git proves to GitHub that it's you, over HTTPS.

The problem

You push to GitHub. Git asks for a password. You type your GitHub password. What happens?

Watch

bash
git push
Username for 'https://github.com': you
Password for 'https://you@github.com':

Your remote address starts with https://. So Git talks to GitHub over HTTPS. Git asks who you are. The password you type stays hidden.

Watch

Which key would you lend a plumber?

A personal access token (PAT): A long secret code Git uses instead of your password. A fine-grained one opens only the repos you pick. is a key for Git. Paste it at that Password prompt. A fine-grained token opens only the repos you pick.

Try it

Make a fine-grained token for your diary. Put the steps in order.

First step at the top. Put these in order. Use the arrows, or drag.

  • Choose only the diary repo
  • Pick Fine-grained tokens. Generate a new one.
  • Generate it and copy it once
  • Give it a name and an end date
  • Allow Contents: Read and write
  • Open Settings, then Developer settings

Watch

Tap each point on the timeline.

Copying tokens is a chore. Git Credential Manager (GCM): A helper that signs Git in to GitHub through your browser and remembers it safely. signs you in with your browser instead. It comes with Git for Windows.

Predict

Your token’s end date was yesterday. You push today. What happens?

Check

Token habits: good, or needs work? Swipe each one.

Swipe right for good, left for needs work. Or use the buttons.

1 / 5

Give every token an end date

You did it!

You can now sign Git in to GitHub over HTTPS, safely.

Go deeper (optional)

Classic tokens still exist, but they can reach every repo you own. GitHub suggests fine-grained ones. On macOS and Linux, install Git Credential Manager yourself. git config --global credential.helper shows which helper Git uses. The GitHub CLI can sign Git in too: next lesson!