GitHub Retires Password Auth for API, Then Git

GitHub has confirmed it will stop accepting account passwords for REST API authentication on November 13, 2020. After that date, all authenticated API operations on GitHub.com must use token-based credentials: a personal access token for developers, or an OAuth token or GitHub App installation token for integrators. The change was first flagged in February 2020 and is now on a firm schedule.

The company is also giving early notice that password-based Git operations will eventually be discontinued. A future migration will require a personal access token, OAuth token, or SSH key for all authenticated Git actions, though no timeline has been set beyond a target of mid-2021. Accounts with two-factor authentication (2FA) enabled will not be affected by the Git change, since such accounts already use tokens for Git operations.

GitHub Enterprise Server remains unaffected by these announcements, as do GitHub Apps, which never relied on password authentication.

Why Tokens Replace Passwords

GitHub has added several account security layers over the years—2FA, sign-in alerts, verified devices, compromised-password screening, and WebAuthn security-key support. These measures reduce the risk of credential-stuffing attacks that reuse passwords across websites. However, accounts without 2FA could still authenticate Git and API calls with a username and password. That legacy path is being closed.

Token-based credentials improve on passwords in several ways:

  • Unique: tokens are tied to GitHub and can be issued per use or per device.
  • Revocable: a compromised token can be revoked individually, leaving other credentials untouched.
  • Limited: tokens can be scoped to the minimum permissions needed for a task.
  • Random: tokens are not susceptible to dictionary or brute-force attacks in the way that human-memorable passwords are.

Immediate Action for API Users

Developers who authenticate against the GitHub API with a password should migrate to a personal access token before the November deadline. Clients that warn about an outdated third-party integration should be updated to a recent release.

Integrators must move to the web or device authorization flows before November 13. Tokens already created through the legacy authorizations API—where a username and password were used to generate the token—will keep working after that date. Existing OAuth integrations and apps must be updated to use the applicable authorization flow.

Preparing for the Git Authentication Change

GitHub is not making changes yet, but recommends that users who currently authenticate Git over HTTPS with a password take two steps in advance:

  1. Create a personal access token for command-line use.
  2. Configure Git to store that token securely, which the documentation recommends.

Users can also enable two-factor authentication now; doing so ensures that Git and third-party integrations already require personal access or OAuth tokens, making the transition invisible when the Git password requirement is removed.

Timeline for the Transition

The enforcement schedule is as follows:

  • Immediately: users authenticating with passwords may receive an email notice to update their authentication method or third-party client.
  • September 30 and October 28: tokens are temporarily required for all API operations as a test window.
  • November 13: tokens are permanently required for all authenticated REST API operations; GraphQL already required a personal access token.
  • Mid-2021: tokens or SSH keys become mandatory for all authenticated Git operations.

Additional details on the Git change are expected later this year. GitHub points those with questions to its developer blog announcement and account security documentation.