How to fix git@github.com: Permission denied (publickey). fatal: Could not read from remote repository. in Git

GitBEGINNERMEDIUMUpdated Dec 6, 2025· 384 views

This error occurs when Git cannot authenticate your SSH connection to a remote repository like GitHub, GitLab, or Bitbucket. The fix involves generating an SSH key, adding it to your SSH agent, and registering the public key with your Git hosting provider.

Quick fix

Fixes git@github.com: Permission denied (publickey). fatal: Could not read from remote repository.

# For GitHub
ssh -T git@github.com

# For GitLab
ssh -T git@gitlab.com

# For Bitbucket
ssh -T git@bitbucket.org

Test your SSH connection
Check for existing SSH keys
Generate a new SSH key (if needed)
Add your SSH key to the SSH agent

git — error

$# For GitHub
ssh -T git@github.com
# For GitLab
ssh -T git@gitlab.com
# For Bitbucket
ssh -T git@bitbucket.org
git@github.com: Permission denied (publickey). fatal: Could not read from remote repository.

What this error means

This error indicates that the remote Git server (such as GitHub, GitLab, or Bitbucket) rejected your SSH connection because it couldn't verify your identity using SSH public key authentication. When you try to clone, push, pull, or fetch from a remote repository using an SSH URL (like `git@github.com:user/repo.git`), Git uses SSH to establish a secure connection. SSH authentication requires a cryptographic key pair: a private key stored on your machine and a public key registered with the Git hosting service. If the server cannot find a matching public key for the private key you're presenting, or if you don't have any SSH keys configured, you'll see this "Permission denied (publickey)" error. The "fatal: Could not read from remote repository" message confirms that Git was unable to access the repository at all because the authentication step failed before any repository access could occur.

Typical symptoms

Clone, push, pull, or fetch operations fail with 'Permission denied (publickey)'
SSH connection to git@github.com (or other hosts) times out or is refused
Error appears immediately when running git commands on SSH remote URLs
Works with HTTPS URLs but fails with SSH/git URLs
'ssh -T git@github.com' returns permission denied
CI/CD pipelines fail at git clone step
Previously working repository suddenly shows authentication errors
Error only appears on specific machines or user accounts

Common causes

No SSH key exists on your machine
SSH key exists but is not added to the SSH agent
Public key is not registered with your GitHub/GitLab/Bitbucket account
SSH key was deleted from your Git hosting provider account
Using sudo with git commands (root user has different SSH keys)
SSH key file has incorrect permissions (too open)
SSH agent is not running
Custom SSH key filename without proper SSH config
Corporate firewall or proxy blocking SSH connections on port 22
Trying to connect with username instead of 'git' user

How to fix "git@github.com: Permission denied (publickey). fatal: Could not read from remote repository."

1Test your SSH connection

First, verify your SSH connection to the Git host:

bash

# For GitHub
ssh -T git@github.com

# For GitLab
ssh -T git@gitlab.com

# For Bitbucket
ssh -T git@bitbucket.org

Expected successful response from GitHub:

bash

Hi username! You've successfully authenticated, but GitHub does not provide shell access.

If you see "Permission denied (publickey)", continue with the next steps.

For verbose output (helpful for debugging):

bash

ssh -vT git@github.com

Look for lines like:
- Offering public key - SSH found a key to try
- No identities found - No SSH keys available

2Check for existing SSH keys

See if you already have SSH keys generated:

bash

# List files in your SSH directory
ls -la ~/.ssh

# Look for these files:
# id_ed25519, id_ed25519.pub  (Ed25519 - recommended)
# id_rsa, id_rsa.pub          (RSA - older but still valid)
# id_ecdsa, id_ecdsa.pub      (ECDSA)

If you see key files (a pair with and without .pub extension), you have SSH keys. If the .ssh directory doesn't exist or is empty, you need to generate new keys.

Check if keys are loaded in the agent:

bash

# Start the SSH agent
eval "$(ssh-agent -s)"

# List loaded keys
ssh-add -l

# If empty: "The agent has no identities."

3Generate a new SSH key (if needed)

If you don't have SSH keys, generate a new key pair:

bash

# Generate Ed25519 key (recommended - more secure and faster)
ssh-keygen -t ed25519 -C "your_email@example.com"

# Or generate RSA key (for older systems that don't support Ed25519)
ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

When prompted:
- File location: Press Enter to accept the default (~/.ssh/id_ed25519)
- Passphrase: Enter a secure passphrase (recommended) or press Enter for no passphrase

bash

Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/you/.ssh/id_ed25519):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/you/.ssh/id_ed25519
Your public key has been saved in /home/you/.ssh/id_ed25519.pub

4Add your SSH key to the SSH agent

The SSH agent manages your keys and handles authentication:

bash

# Start the SSH agent in the background
eval "$(ssh-agent -s)"
# Output: Agent pid 12345

# Add your private key to the agent
ssh-add ~/.ssh/id_ed25519

# Or for RSA keys:
ssh-add ~/.ssh/id_rsa

If you set a passphrase, you'll be prompted to enter it when adding the key.

On macOS, to persist the key across restarts:

bash

# Add to keychain (macOS only)
ssh-add --apple-use-keychain ~/.ssh/id_ed25519

# Add this to ~/.ssh/config to auto-load keys:
Host *
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/id_ed25519

Verify the key is loaded:

bash

ssh-add -l -E sha256

5Add your public key to GitHub/GitLab/Bitbucket

Copy your public key to the clipboard:

bash

# macOS
cat ~/.ssh/id_ed25519.pub | pbcopy

# Linux (with xclip)
cat ~/.ssh/id_ed25519.pub | xclip -selection clipboard

# Windows (Git Bash)
cat ~/.ssh/id_ed25519.pub | clip

# Or just display it and copy manually
cat ~/.ssh/id_ed25519.pub

For GitHub:
1. Go to https://github.com/settings/keys
2. Click "New SSH key"
3. Give it a descriptive title (e.g., "Work Laptop")
4. Paste your public key
5. Click "Add SSH key"

For GitLab:
1. Go to https://gitlab.com/-/profile/keys
2. Paste your public key
3. Set an expiration date (optional)
4. Click "Add key"

For Bitbucket:
1. Go to Personal settings > SSH keys
2. Click "Add key"
3. Paste your public key
4. Click "Add key"

6Verify the connection works

Test the SSH connection again:

bash

ssh -T git@github.com

Expected success message:

bash

Hi username! You've successfully authenticated, but GitHub does not provide shell access.

Now test a git operation:

bash

# Clone a repository
git clone git@github.com:username/repository.git

# Or if you have an existing repo, test fetch
git fetch origin

If you still see errors, check the troubleshooting steps below.

7Configure SSH for custom key names or multiple keys

If you saved your key with a custom name or have multiple keys, create an SSH config file:

bash

# Create or edit SSH config
nano ~/.ssh/config

Example configuration:

bash

# GitHub account
Host github.com
  HostName github.com
  User git
  IdentityFile ~/.ssh/github_key
  IdentitiesOnly yes

# GitLab account
Host gitlab.com
  HostName gitlab.com
  User git
  IdentityFile ~/.ssh/gitlab_key
  IdentitiesOnly yes

# Personal GitHub (for multiple accounts)
Host github-personal
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_ed25519_personal
  IdentitiesOnly yes

Using the personal GitHub alias:

bash

git clone git@github-personal:username/repo.git

Set correct permissions on the config file:

bash

chmod 600 ~/.ssh/config

8Fix SSH key file permissions

SSH requires strict permissions on key files. If permissions are too open, SSH will refuse to use the key:

bash

# Set correct permissions
chmod 700 ~/.ssh                 # Directory: owner only
chmod 600 ~/.ssh/id_ed25519      # Private key: owner read/write only
chmod 644 ~/.ssh/id_ed25519.pub  # Public key: owner read/write, others read
chmod 600 ~/.ssh/config          # Config: owner read/write only

# Verify permissions
ls -la ~/.ssh
# Should show: drwx------ for .ssh
# Should show: -rw------- for private keys

Common permission error messages:

bash

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/home/user/.ssh/id_ed25519' are too open.

9Alternative: Use HTTPS instead of SSH

If SSH is blocked or you prefer not to use it, switch to HTTPS authentication:

bash

# Clone using HTTPS
git clone https://github.com/username/repository.git

# Change existing remote from SSH to HTTPS
git remote set-url origin https://github.com/username/repository.git

# Verify the change
git remote -v

For HTTPS authentication, use a Personal Access Token (PAT):

1. Generate a token at https://github.com/settings/tokens
2. Select appropriate scopes (repo access)
3. Use the token as your password when prompted

Cache HTTPS credentials:

bash

# Cache credentials for 1 hour (3600 seconds)
git config --global credential.helper 'cache --timeout=3600'

# On macOS, use the keychain
git config --global credential.helper osxkeychain

# On Windows, use the credential manager
git config --global credential.helper manager

Advanced notes

### Avoid Using sudo with Git

Never use sudo with git commands when working with SSH:

bash

# Wrong - uses root's SSH keys
sudo git clone git@github.com:user/repo.git

# Correct - uses your SSH keys
git clone git@github.com:user/repo.git

The root user has a different home directory (/root) and therefore different SSH keys than your user account.

### Using SSH Over HTTPS Port (443)

If your network blocks SSH on port 22, GitHub allows SSH connections over port 443:

bash

# Test if port 443 works
ssh -T -p 443 git@ssh.github.com

# Add to ~/.ssh/config
Host github.com
  HostName ssh.github.com
  Port 443
  User git
  IdentityFile ~/.ssh/id_ed25519

### SSH Agent Forwarding

To use your local SSH keys on a remote server:

bash

# Connect with agent forwarding
ssh -A user@remote-server

# On the remote server, git commands will use your forwarded keys
git clone git@github.com:user/repo.git

Security note: Only use agent forwarding with servers you trust.

### Debugging SSH Connections

Use verbose mode to diagnose issues:

bash

# Increasing verbosity levels
ssh -v git@github.com    # Basic debug
ssh -vv git@github.com   # More detail
ssh -vvv git@github.com  # Maximum verbosity

Look for:
- Authentications that can continue: publickey
- Offering public key: /path/to/key
- Server accepts key: /path/to/key
- Authentication succeeded (publickey)

### Multiple GitHub Accounts

If you have multiple GitHub accounts (e.g., personal and work):

bash

# ~/.ssh/config
Host github.com-work
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_ed25519_work

Host github.com-personal
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_ed25519_personal

Clone using the host alias:

bash

git clone git@github.com-work:company/repo.git

### Deploy Keys for CI/CD

For servers and CI/CD pipelines, use deploy keys instead of personal SSH keys:

1. Generate a dedicated key pair for the server
2. Add the public key as a Deploy Key in the repository settings
3. Deploy keys can be read-only or read-write per repository

### SSH Key Types Comparison

| Type | Command | Security | Compatibility |
|------|---------|----------|---------------|
| Ed25519 | ssh-keygen -t ed25519 | Excellent | Modern systems |
| RSA 4096 | ssh-keygen -t rsa -b 4096 | Good | Universal |
| ECDSA | ssh-keygen -t ecdsa -b 521 | Good | Most systems |

Ed25519 is recommended for new keys due to better security and smaller key size.

### Regenerating Known Hosts

If you see a host key verification error:

bash

# Remove old host key
ssh-keygen -R github.com

# Reconnect to add new key
ssh -T git@github.com
# Type 'yes' to accept the new fingerprint

Verify the fingerprint matches GitHub's published fingerprints before accepting.

Frequently asked questions

What does "git@github.com: Permission denied (publickey). fatal: Could not read f" mean?: This error indicates that the remote Git server (such as GitHub, GitLab, or Bitbucket) rejected your SSH connection because it couldn't verify your identity using SSH public key authentication. git), Git uses SSH to establish a secure connection. SSH authentication requires a cryptographic key pair: a private key stored on your machine and a public key registered with the Git hosting service.
How do I fix "git@github.com: Permission denied (publickey). fatal: Could not read f"?: This error occurs when Git cannot authenticate your SSH connection to a remote repository like GitHub, GitLab, or Bitbucket. The fix involves generating an SSH key, adding it to your SSH agent, and registering the public key with your Git hosting provider.
What causes "git@github.com: Permission denied (publickey). fatal: Could not read f"?: No SSH key exists on your machine SSH key exists but is not added to the SSH agent Public key is not registered with your GitHub/GitLab/Bitbucket account
Is the "git@github.com: Permission denied (publickey). fatal: Could not read f" error serious?: It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading

📚Git Official Documentation
📖
GitHub Docs - Error: Permission denied (publickey)(Official Docs)
📖
GitHub Docs - Connecting to GitHub with SSH(Official Docs)
📖
GitLab Docs - Use SSH keys to communicate with GitLab(Official Docs)
💬
Stack Overflow - GitHub: Permission denied (publickey)(Stack Overflow)
💬
Stack Overflow - GitHub Error Message - Permission denied (publickey)(Stack Overflow)
💬
Stack Overflow - Git: Permission denied (publickey) fatal(Stack Overflow)

How to fix git@github.com: Permission denied (publickey). fatal: Could not read from remote repository. in Git

Quick fix

What this error means

Typical symptoms

Common causes

How to fix "git@github.com: Permission denied (publickey). fatal: Could not read from remote repository."

Advanced notes

Frequently asked questions

Related errors

Official resources & further reading