Git.eu Documentation

Your Code. Your Rules.

Access Denied (403)

remote: Access denied - The requested URL returned error: 403 - token without the Git access scope, revoked, expired or stale, or a push with read-only access.

Access Denied (403)

Symptom

remote: Access denied
fatal: unable to access 'https://<INSTANCE>.git.eu/<USERNAME>/<REPO>.git/': The requested URL returned error: 403

Cause

The server read a token but refused the operation:

  • the token does not have the Git access scope;
  • the token was revoked, has expired, or is mistyped;
  • the token is stale: a credential helper still holds an old token and sends it again on every command (git does not drop it after a 403);
  • you push to a repository where you only have read access.

Diagnose

1. Open Settings → Git Access → Tokens and check that the token is listed, not expired, and has the Git access scope.

2. Try a read:

git ls-remote https://<INSTANCE>.git.eu/<USERNAME>/<REPO>.git

If the read works and only the push fails, you have read access only.

3. Show the token git sends (clear text, run it only on your own screen):

printf 'protocol=https\nhost=<INSTANCE>.git.eu\n\n' | git credential fill

Fix

Option A - Replace the token (recommended)

Create a new token with the Git access scope in Settings → Git Access → Tokens, then drop the old one from git.

git does not drop a stored credential after a 403: every command sends the same value again and fails the same way. Remove it from every configured helper (store, an OS keychain, Git Credential Manager):

printf 'protocol=https\nhost=<INSTANCE>.git.eu\n\n' | git credential reject

The next git command asks for a username and password: paste the token as the password.

Option B - Get write access

For a push to someone else's repository, ask the owner to add you as a collaborator with write access.

Verify

git ls-remote https://<INSTANCE>.git.eu/<USERNAME>/<REPO>.git
git push

Both commands end without Access denied.

Prevent

  • Give tokens an expiry and replace them before it, then reject the old one from the credential helper.
  • Revoke a token the moment it leaks, and create a new one.

Related