How to Fix “403 Forbidden” When Pushing to GitHub with SSH

You set up SSH keys. Tested them with `ssh -T git@github.com`. It says “Hi username!” You’re good. But `git push` returns `403 Forbidden`. You didn’t change your password. You didn’t enable 2FA. What’s wrong?

You’re likely using HTTPS in your remote URL — even though you think you’re using SSH.

—

**Examples and Tools**

- SSH: `git@github.com:username/repo.git`
- HTTPS: `https://github.com/username/repo.git`
- `git remote -v`: The command to check your remote URL
- GitHub Personal Access Tokens (PATs): Required for HTTPS since Aug 2021
- `ssh-add -l`: Lists loaded SSH keys

—

**Actionable Tips**

1. Run: `git remote -v`
2. If you see `https://`, that’s your problem.
3. Fix it: `git remote set-url origin git@github.com:yourusername/yourrepo.git`
4. Confirm: `git remote -v` should now show SSH format.
5. If you *must* use HTTPS, generate a PAT (Settings > Tokens > Classic) and use it as your password.
6. Ensure your SSH key is added to your GitHub account: Settings > SSH and GPG keys.

—

**What This Means for You**

- No more typing passwords or PATs every time you push.
- Secure, seamless authentication with SSH.
- Avoid token expiration surprises.

—

**Key Takeaways**

- “403 Forbidden” on SSH = you’re not actually using SSH.
- Always check `git remote -v` before debugging keys.
- SSH keys must be added to GitHub — not just generated locally.

—

**Future Implications**

- GitHub is phasing out password authentication entirely.
- SSH key management will become part of CI/CD credential pipelines.
- Git clients will auto-detect and suggest protocol fixes.

—

**Sources**
https://docs.github.com/en/authentication/troubleshooting-ssh/error-permission-denied-publickey
https://github.blog/2020-12-15-token-authentication-requirements-for-git-operations/
https://docs.github.com/en/authentication/connecting-to-github-with-ssh

---