Sign in to GitHub and GitLab
Beginner IntelliJ UI
Why this matters
As in VS Code, two different authentications are in play, and the symptoms look similar. Knowing which is which is the difference between a two-minute fix and an afternoon.
Two authentications
| The IDE account | Git's credentials | |
|---|---|---|
| Used for | Merge requests, pull requests, issues, pipelines | git push, git pull, git fetch |
| Configured at | Settings → Version Control → GitHub or → GitLab | The first push, or your SSH key |
| Stored in | IntelliJ's password store, backed by the system keychain | The credential manager, or the SSH agent |
| Fails with | "Sign in" prompts inside the IDE | Authentication failed, Permission denied |
Adding an account
Settings → Version Control → GitHub → Add account offers two routes: Log In with Token and a browser-based sign-in. The token route is the one to use when your organization requires it, or for a self-managed server.
For GitLab: Settings → Version Control → GitLab → Add account, which asks for the server URL and a personal access token with the api scope (lesson 8.3).
Both then appear in the Pull Requests or Merge Requests tool window (lesson 16.9).
Git's credentials
The first push over HTTPS prompts for a username and a token. Where that is stored depends on Settings → Appearance and Behavior → System Settings → Passwords, which offers the native keychain, KeePass, or not saving at all.
If the stored credential is wrong or has expired, the reliable fix is to remove it there and let the next push ask again. Over SSH, no password is involved at all, which is one reason to prefer it (lesson 8.1).
Which one is broken?
| Symptom | Which | Fix |
|---|---|---|
| The Merge Requests window says to log in | The IDE account | Add or re-add the account |
Push fails with Authentication failed |
Git's credential | Replace the stored token |
Push fails with Permission denied (publickey) |
Your SSH key | Lesson 8.2 |
Push is rejected as non-fast-forward |
Neither: the branch moved | Pull, then push (lesson 7.6) |
That last row is worth remembering. A rejected push is usually not an authentication problem at all, and reinstalling accounts will not help.
Several accounts
IntelliJ supports more than one account per platform, with a default chosen per project, which is genuinely useful for work and personal repositories on one machine. Set the commit identity per repository as well, so the commits match the account (lesson 3.4):
$ git config user.email "ana@northwind-trails.example"How to do it
$ git remote -v
$ ssh -T git@gitlab.comThe first says whether Git will use a token or a key; the second checks the key. Neither has anything to do with the IDE's accounts.
The Accounts menu and the extensions do the same job, with the same separation. See lesson 15.3.
- Settings → Version Control → GitHub → Add account
- Settings → Version Control → GitLab → Add account (URL plus a token with
api) - Settings → Appearance and Behavior → System Settings → Passwords for how credentials are stored
- Find Action (⇧⌘A) → "GitHub" or "GitLab" to reach either quickly
Create the token at avatar → Edit profile → Access → Personal access tokens. api for the IDE integration; write_repository if the same token also pushes over HTTPS.
Fine-grained tokens at Settings → Developer settings → Personal access tokens → Fine-grained tokens, or use the browser sign-in and let the IDE handle it (lesson 10.12).
Common mistakes
- Expecting the account to fix a push.
- A token with far more scopes than needed.
- No expiry on a token.
- Committing with the wrong identity on a machine with two accounts.
- Removing and re-adding the account to fix a Git credential problem.
Try it yourself
Goal: set up both, and be able to name which is which.
- Add your platform account in Settings → Version Control.
- Confirm it works: open the Merge Requests or Pull Requests tool window and see your project's list.
- Push a commit. Anything it asks for is Git, not the IDE.
- Open Settings → Appearance and Behavior → System Settings → Passwords and note where credentials are stored.
- Write one sentence for each of these symptoms, naming which authentication is at fault: an empty merge request list; a push rejected with
Authentication failed.
Expected result: both work, and you can diagnose either from the symptom.
Show solution
The rule from step 5 generalises to every graphical Git tool: anything shown inside the IDE about the platform is the account; anything Git reports over the network is the credential. Two systems that happen to talk to the same server.