Authentication documentation

You can securely access your account's resources by authenticating to GitHub, using different credentials depending on where you authenticate.

Using GPG, SSH, or S/MIME, you can sign tags and commits locally. These tags or commits are marked as verified on GitHub so other people can be confident that the changes come from a trusted source.

Passkeys allow you to sign in safely and easily, without requiring a password and two-factor authentication.

Using the SSH protocol, you can connect and authenticate to remote servers and services. With SSH keys, you can connect to GitHub without supplying your username and personal access token at each visit. You can also use an SSH key to sign commits.

Two-factor authentication (2FA) is an extra layer of security used when logging into websites or apps. With 2FA, you have to log in with your username and password and provide another form of authentication that only you know or have access to.

With 2FA enabled, you'll be asked to provide your 2FA authentication code, as well as your password, when you sign in to GitHub.

To configure your account on GitHub to use your new (or existing) GPG key, you'll also need to add the key to your account.

To configure your account on your GitHub Enterprise Server instance to use your new (or existing) SSH key, you'll also need to add the key to your account.

Your GPG key must be associated with a verified email that matches your committer identity.