Hub: Username / password fails with for private repos with "remote: Invalid username or password."

[mshick]

I've been through all the issues here, none seem applicable. I'm just starting with hub, and have tried cloning a number of private repos -- nothing seems to work. I've been through all the open and closed issues here, but none seem to apply. The failure happens very early, and HUB_VERBOSE=1 just gives me some of the setup commands being used. I've verified my username and password, logged-out of the website, and back in. I am using TFA, and that works correctly vis SMS. git works perfectly fine on its own.

System info:

OS X 10.11.4
hub installed via brew

❯ git --version
git version 2.6.4 (Apple Git-63)
hub version 2.2.3

sample output:

❯ HUB_VERBOSE=1 hub clone mshick/private-repo
$ git config alias.clone
$ git config hub.protocol
$ git config hub.protocol
$ git clone https://github.com/mshick/private-repo.git
Cloning into 'arrivals-osx'...
Username for 'https://github.com': mshick   
Password for 'https://[email protected]': 
remote: Invalid username or password.
fatal: Authentication failed for 'https://github.com/mshick/private-repo.git/'

attempting a curl request (spotted in one of the issues) gives this. I don't know that this actually applies to hub though.

❯ curl -u mshick https://api.github.com/user
Enter host password for user 'mshick':
{
  "message": "Must specify two-factor authentication OTP code.",
  "documentation_url": "https://developer.github.com/v3/auth#working-with-two-factor-authentication"
}

[mshick]

Oof. The problem was that I've always used ssh, but now realize hub is using https. I had never configured my account for a personal access token. I've done that now and things are working. Thanks!

[ELmardi2]

2 tanté

[SuperMaZingCoder]

I just found this article as well. Explains a bit why it happens. In most cases, it is because 2FA breaks the login from the command line, so generating a token with certain permissions can get around that.

For setting permissions, you may want to check all of them in to make sure that you won't run into any permission problems later on, just be careful that you never share the token.