{"meta":{"title":"Troubleshooting GitHub Copilot CLI authentication","intro":"Diagnose authentication failures when signing in to Copilot CLI.","product":"GitHub Copilot","breadcrumbs":[{"href":"/en/copilot","title":"GitHub Copilot"},{"href":"/en/copilot/how-tos","title":"How-tos"},{"href":"/en/copilot/how-tos/copilot-cli","title":"Copilot CLI"},{"href":"/en/copilot/how-tos/copilot-cli/set-up-copilot-cli","title":"Set up Copilot CLI"},{"href":"/en/copilot/how-tos/copilot-cli/set-up-copilot-cli/troubleshoot-copilot-cli-auth","title":"Troubleshoot Copilot CLI auth"}],"documentType":"article"},"body":"# Troubleshooting GitHub Copilot CLI authentication\n\nDiagnose authentication failures when signing in to Copilot CLI.\n\n## Authentication errors\n\nIf you encounter authentication errors, use the table below to identify the cause and resolution.\n\n| Issue | Cause | Fix | More information |\n| ----------------------------------- | ----------------------------------------- | --------------------------------------- | --------------------------------------------------------------------------- |\n| No authentication information found | No credentials stored | Run `copilot login` | [No authentication information found](#no-authentication-information-found) |\n| 401 Unauthorized | Token revoked or insufficient permissions | Generate token with permissions | [Token expired or revoked](#token-expired-or-revoked) |\n| Token (classic) rejected | Token (classic) (`ghp_`) | Use fine-grained personal access token | [Token (classic) rejected](#token-classic-rejected) |\n| 403 Forbidden or policy denied | Copilot license or enterprise/org policy | Check subscription and org settings | [Access denied](#access-denied) |\n| Keychain unavailable | Missing system keychain | Install `libsecret` or accept plaintext | [Keychain access failure](#keychain-access-failure) |\n| Wrong account | Multiple accounts or env var override | Check env vars, use `/user switch` | [Wrong account](#wrong-account) |\n\n## No authentication information found\n\nCopilot CLI displays the following error:\n\n\n\n```text\nError: No authentication information found\nCopilot can be authenticated with GitHub using an OAuth Token or a Fine-Grained Personal Access Token\n```\n\n\n\n### Cause\n\nNo credentials exist in any of the checked locations.\n\n### Fix\n\nUse the following steps to find where authentication is missing and restore access.\n\n#### Check your authentication status\n\n```bash copy\ngh auth status\n```\n\nIf you see a message indicating that you’re not logged in, log in with `gh auth login` or use the OAuth flow with `copilot login`.\n\n#### Check whether an authentication environment variable is set\n\nIf you are using an environment variable, check whether the `COPILOT_GITHUB_TOKEN`, `GH_TOKEN`, or `GITHUB_TOKEN` environment variable is set:\n\n```bash copy\necho $COPILOT_GITHUB_TOKEN\n```\n\nIf the command prints nothing, the variable is not set. Set the variable to a valid token. To generate a token, see [Authenticating GitHub Copilot CLI](/en/copilot/how-tos/copilot-cli/set-up-copilot-cli/authenticate-copilot-cli#authenticating-with-environment-variables).\n\n```bash copy\n export $COPILOT_GITHUB_TOKEN=PERSONAL_ACCESS_TOKEN\n```\n\n#### macOS keychain\n\n```bash copy\nsecurity find-generic-password -s copilot-cli\n```\n\nIf no item is found, authenticate again with `/login` or `copilot login` to create one.\nIf an item is found but authentication still fails, remove the saved credential then authenticate again with `/login` or `copilot login`:\n\n```bash copy\n security delete-generic-password -s copilot-cli\n```\n\n## Token expired or revoked\n\nCopilot CLI displays the following error:\n\n\n\n```text\nError: Authentication failed\n\nYour GitHub token may be invalid, expired, or lacking the required permissions.\n\nTo resolve this, try the following:\n • Start 'copilot' and run the '${LOGIN_COMMAND}' command to re-authenticate\n • If using a Fine-Grained PAT, ensure it has the 'Copilot Requests' permission enabled\n • If using COPILOT_GITHUB_TOKEN, GH_TOKEN or GITHUB_TOKEN environment variable, verify the token is valid and not expired\n • Run 'gh auth status' to check your current authentication status\n```\n\n\n\n### Cause\n\nThe token was revoked, has expired, or was created without the required permissions.\n\n### Fix\n\nReview the token's status and permissions on GitHub. The token must be a fine-grained personal access token owned by your **personal account** (not an organization) with the **Copilot Requests** permission. Generate a new token with the required permissions if necessary.\n\n## Token (classic) rejected\n\nA token starting with `ghp_` is silently ignored and the CLI behaves as if no token is set.\n\n### Cause\n\nClassic personal access tokens are not supported by Copilot CLI.\n\n### Fix\n\nGenerate a fine-grained personal access token with the required scopes.\n\n## Access denied\n\nCopilot CLI displays one of the following errors:\n\n```text\nError: Access denied by policy settings\n\nYour Copilot CLI policy setting may be preventing access. This can happen when:\n • Your organization has restricted Copilot access\n • Your Copilot subscription does not include this feature\n • Required policies have not been enabled by your administrator\n\nTo resolve this, visit your Copilot settings: \n```\n\n### Cause\n\nAn organization policy blocks GitHub Copilot CLI, or the user account lacks a GitHub Copilot license.\n\n### Fix\n\n* Check that your account has an active GitHub Copilot license.\n* Ask your organization admin to enable GitHub Copilot CLI in the organization policy.\n\n## Keychain access failure\n\nDuring login, the CLI prompts you about the system keychain being unavailable and asks whether to store credentials in plaintext.\n\n```text\nSystem keychain unavailable. Store token in plaintext config file? (y/N)\n```\n\n### Cause\n\nThe system keychain is not accessible. This may occur on Linux systems without `libsecret`, headless servers, or systems with a permission issue.\n\n### Fix\n\nFollow the steps for your operating system to restore secure credential storage.\n\n#### macOS or Windows\n\nOn macOS, confirm Keychain Access app is available, and you can unlock your login keychain.\nOn Windows, confirm Credential Manager is available, and you can access the Windows Vault.\nIf you can’t access the system credential manager, use plaintext storage (if prompted) or authenticate using an environment variable token, then rerun `/login` or `copilot login`.\n\n#### Linux\n\nOn Linux, use the system keyring or store credentials in plaintext.\n\n1. Check whether `secret-tool` is installed:\n\n ```bash copy\n command -v secret-tool\n ```\n\n2. If `secret-tool` is not found or the search command returns no results, install `libsecret` and its dependencies. For example, on Debian and Ubuntu you could use the following command.\"\n\n ```bash copy\n sudo apt install libsecret-1-0 gnome-keyring seahorse\n ```\n\n3. Once `secret-tool` is installed, search the keyring for a saved credential:\n\n ```bash copy\n secret-tool search copilot-cli\n ```\n\n If the command returns one or more results, credentials exist in the keyring. Run `copilot login` in the terminal or `/login` in Copilot CLI again.\n\n## Wrong account\n\nThe wrong user is authenticated, or the token belongs to the wrong organization.\n\n### Cause\n\nMultiple accounts are stored, or an environment variable is overriding the stored token.\n\n### Fix\n\nTo switch accounts, use `/user switch` at the CLI prompt, or sign out with `/logout` and run `/login` with the correct account."}