GitHub may temporarily require authentication for some public HTTPS clones

GitHub announced on October 19, 2026, that some public-repository clones and fetches over HTTPS may temporarily require authentication during unusual traffic. That can interrupt an automated source checkout even though the repository is still public.

Why a public repository may require authentication

GitHub applies the protection as narrowly as possible using signals associated with anomalous traffic. Legitimate unauthenticated operations can sometimes share those signals and be affected, failing with a message that authentication is required.

This is not a general authentication requirement for public repositories. The protection applies to repositories on github.com across all plans, and GitHub has not specified an exact duration.

What to do if a clone or fetch is stopped

You can authenticate and retry the affected operation. If you cannot authenticate, or prefer to continue without authentication, wait until the temporary protection has been lifted before trying again.

Authenticated Git operations over HTTPS, Git operations over SSH and pushes are unaffected. Unrelated GitHub web and API traffic is also unaffected, so there is no need to change an SSH setup that already works.

For automated checkouts, GitHub recommends authentication

For GitHub Actions, GitHub recommends the built-in GITHUB_TOKEN. For other continuous integration systems, it prefers a GitHub App installation access token; a personal access token is also an option.