Diagnosing and Fixing Authentication Failed Errors in Sourcetree for HTTPS and SSH Connections

Recognizable Condition

When you try to push, pull, or clone a repository in Sourcetree you see an “Authentication failed” dialog or the operation aborts with a message such as “remote: Invalid username or password” (HTTPS) or “Permission denied (publickey)” (SSH).

Useful takeaway: most failures are caused by an expired or mismatched token, stale OS credentials, an SSH key that the client cannot use, or a mismatch between the SSH client Sourcetree is configured to use and the one that holds your key.

Common Causes and Diagnostic Indicators

Ordered Diagnostic Checks

1. Identify the URL scheme of the remote repository (HTTPS or SSH) in Sourcetree’s repository settings (Repository → Repository Settings → Remote).
2. If HTTPS:
   1. Open Tools → Options → Accounts, select the hosting service (GitHub, GitLab, Bitbucket) and verify the Personal Access Token is present and not expired.
   2. Check the OS credential store for any stored username/password for the same host and note it.
3. If SSH:
   1. Confirm the private key file exists (usually ~/.ssh/id_rsa or ~/.ssh/id_ed25519) and that its permissions are 600 (read/write for owner only).
   2. Run ssh-add -l in a system terminal to see if the key is loaded into the agent.
   3. In Sourcetree, go to Tools → Options → General and note which SSH client is selected (Embedded or System).
4. Test connectivity from Sourcetree’s integrated terminal:
   1. Click the Terminal button, ensure you are in the repository’s working directory.
   2. Run git ls-remote <remote‑url> (replace <remote‑url> with the HTTPS or SSH URL).
   3. Observe the output: a list of refs indicates success; an authentication error repeats the original failure.

Fixes Tied to Findings

Expired or Incorrect PAT (HTTPS)

1. Generate a new token on the provider’s website with the required scopes (e.g., repo, read:org).
2. In Sourcetree: Tools → Options → Accounts → select the host → click Edit → paste the new token → Save.
3. If you found stale credentials in the OS store, remove them:
   • Windows: Control Panel → Credential Manager → Windows Credentials → locate git:https://host and choose Remove.
   • macOS: Open Keychain Access, search for the host, delete the internet password entry.
4. Return to the repository and try the operation again.

SSH Key Permission Problems

1. In a system terminal run: chmod 600 ~/.ssh/id_rsa (adjust filename if you use a different key).
2. Ensure the key is owned by your user: chown $USER:$USER ~/.ssh/id_rsa.
3. If the key is passphrase‑protected, load it into the agent: ssh-add ~/.ssh/id_rsa and enter the passphrase when prompted.

SSH Agent Not Supplying Key

1. Start the agent if not running: eval `ssh-agent -s` (Linux/macOS) or ensure Pageant is running (Windows).
2. Add the key: ssh-add ~/.ssh/id_rsa.
3. Verify with ssh-add -l that the key appears.
4. In Sourcetree, make sure the SSH client setting points to the System client so it can access the same agent.

Mismatched SSH Client in Sourcetree

1. Open Tools → Options → General.
2. Under SSH client, select System if you normally use ssh-agent or Pageant; select Embedded only if you prefer the built‑in client and have configured its keys separately.
3. Restart Sourcetree to apply the change.

Escalation Criteria

• If after completing the checks above the git ls-remote command still returns an authentication error, verify that the remote URL itself is correct (no typos, correct protocol).
• For HTTPS, confirm that the token still has the required scopes and has not been revoked by the provider’s security policies.
• For SSH, ensure the public key corresponding to your private key is uploaded to the hosting service (GitHub → Settings → SSH and GPG keys, etc.).
• If the key is correct and the agent is running but Sourcetree still fails, try cloning the repository fresh using the system Git command line to isolate whether the issue is Sourcetree‑specific.
• When the problem persists across multiple repositories and both HTTPS and SSH, consider resetting Sourcetree’s stored credentials (Tools → Options → Accounts → Remove all) and re‑adding them, or reinstalling Sourcetree to a known‑good version.

After applying a fix, repeat the git ls-remote test in the integrated terminal. Successful output (a list of refs) confirms the authentication barrier is removed.