Sign in to GitHub and GitLab
Beginner VS Code UI
Why this matters
There are two separate authentications in play, and confusing them is the source of most "I signed in but it still will not push" confusion. Five minutes here prevents an hour of it.
Two authentications, not one
| The editor's account | Git's credentials | |
|---|---|---|
| Used for | Merge requests, issues, pipelines: anything through the platform's API | git push, git pull, git fetch |
| Stored by | VS Code, in the operating system keychain | The credential manager, or your SSH key |
| Signed in through | The Accounts menu or an extension | The first push, or ssh-add |
| Fails with | "Sign in to continue" inside the editor | Authentication failed from Git |
Signing in to VS Code does not give Git a credential. They are separate systems, and the second one is covered in Section 8.
GitHub
The Accounts icon at the bottom of the Activity Bar signs the editor in to GitHub, and so does the GitHub Pull Requests and Issues extension's Sign In prompt. Both open a browser, ask you to authorize, and hand a token back to VS Code, which stores it in the keychain.
Once signed in, the editor can list your repositories when cloning, show pull requests and issues, and publish a local repository to a new GitHub repository.
GitLab
GitLab needs the GitLab Workflow extension and a personal access token (lesson 8.3):
- Install the GitLab Workflow extension.
- Create a token on GitLab: avatar → Edit profile → Access → Personal access tokens → Generate token, with the
apiscope and an expiry you can live with. - In VS Code, Command Palette → GitLab: Authenticate, choose GitLab.com or enter your company's URL, and paste the token.
- The token is stored in the keychain, and merge requests, issues and pipelines appear in the sidebar.
The api scope is needed because the extension reads merge requests and pipelines. Git itself needs only write_repository, which is why a token that pushes fine may still leave the extension unable to sign in, and the reverse.
When a push asks for a password
Git, not VS Code, is asking. Three possibilities:
| Symptom | Cause | Fix |
|---|---|---|
| A prompt appears every time | No credential manager configured | Set one up (lesson 8.4) |
Authentication failed after months of working |
The token expired | Create a new token and update the stored credential |
Permission denied (publickey) |
SSH key not loaded or not on the account | Lesson 8.2 |
To replace a stored credential, the reliable route is the operating system's keychain, or git credential-manager erase where that tool is installed. VS Code has no interface for Git's credentials, which is exactly the distinction this lesson is about.
Several accounts
Work and personal accounts on the same machine is a common and annoying situation. Two things help:
- Per-repository identity:
git config user.emailinside the repository, so commits are attributed correctly (lesson 3.4). - VS Code profiles: Command Palette → Profiles: Create Profile gives a separate set of extensions and settings, which can hold the other account's sign-in.
How to do it
To see which credential Git will use:
$ git remote -v
$ git config user.emailAn https:// remote uses a token from the credential manager; a git@ remote uses your SSH key. Neither has anything to do with the editor's Accounts menu.
- Accounts menu (bottom of the Activity Bar) → Sign in with GitHub
- Command Palette → GitLab: Authenticate for GitLab
- Command Palette → Profiles: Create Profile for a second account
Settings → Version Control → GitHub or → GitLab, then Add account, by token or through the browser. Same separation: the account is for the API, Git uses the credential helper or SSH.
Create the token at avatar → Edit profile → Access → Personal access tokens, with api for the extension and write_repository if the same token will also push over HTTPS.
Fine-grained personal access tokens live at Settings → Developer settings → Personal access tokens → Fine-grained tokens; the editor's own sign-in uses OAuth and needs no token (lesson 10.12).
Common mistakes
- Expecting the editor's sign-in to fix a rejected push.
- Giving a token more scopes than needed.
apifor the extension,write_repositoryfor Git. - No expiry on a token, so it is never revoked.
- Signing in to the wrong account on a shared machine, then committing with the wrong identity.
- Reinstalling the extension to fix a Git credential problem.
Try it yourself
Goal: get both authentications working and be able to tell them apart.
- Sign the editor in to your platform: the Accounts menu for GitHub, or GitLab: Authenticate for GitLab.
- Confirm it worked by finding your repositories in Git: Clone, or merge requests in the sidebar.
- Now push a commit. If it asks for anything, that is Git, not the editor.
- Run
git remote -vand note whether your remote is HTTPS or SSH; that decides which credential Git uses. - Write one sentence naming which authentication would fail for each of: the pull request list is empty; the push is rejected.
Expected result: both work, and you can name which one is at fault from the symptom alone.
Show solution
Step 5 is the takeaway. Anything shown inside the editor about the platform is the account; anything Git reports on the network is the credential. That single distinction resolves most authentication confusion in a graphical tool.