GH-AUTH-LOGIN(1) GitHub CLI manual GH-AUTH-LOGIN(1)

# [NAME](#NAME)

gh-auth-login - Log in to a GitHub account

# [SYNOPSIS](#SYNOPSIS)

**gh auth login \[flags]**

# [DESCRIPTION](#DESCRIPTION)

Authenticate with a GitHub host.

The default hostname is **github.com**. This can be overridden using the **--hostname** flag.

The default authentication mode is a web-based browser flow. After completion, an authentication token will be stored securely in the system credential store. If a credential store is not found or there is an issue using it gh will fallback to writing the token to a plain text file. See **gh auth status** for its stored location.

Alternatively, use **--with-token** to pass in a personal access token (classic) on standard input. The minimum required scopes for the token are: **repo**, **read:org**, and **gist**. Take care when passing a fine-grained personal access token to **--with-token** as the inherent scoping to certain resources may cause confusing behaviour when interacting with other resources. Favour setting **GH\_TOKEN** for fine-grained personal access token usage.

Alternatively, gh will use the authentication token found in environment variables. This method is most suitable for "headless" use of gh such as in automation. See **gh help environment** for more info.

To use gh in GitHub Actions, add **GH\_TOKEN: ${{ github.token }}** to **env**.

The git protocol to use for git operations on this host can be set with **--git-protocol**, or during the interactive prompting. Although login is for a single account on a host, setting the git protocol will take effect for all users on the host.

Specifying **ssh** for the git protocol will detect existing SSH keys to upload, prompting to create and upload a new key if one is not found. This can be skipped with **--skip-ssh-key** flag.

Use **--expiring** to prefer expiring credentials that gh refreshes automatically. This is a preference, not a guarantee: whether expiring tokens are issued depends on the host and the OAuth app configuration. A host without support issues a non-expiring token instead, and a host configured for them may issue expiring tokens even without the flag. Enable the **expiring\_credentials** configuration to prefer expiring credentials without passing **--expiring** every time, and pass **--expiring=false** to request a non-expiring token even when that configuration is enabled. When using expiring credentials for git operations, git 2.46 or newer is recommended so gh can mark the token as non-cacheable; with older git a credential caching helper may store and reuse an expired token.

For more information on OAuth scopes, see

⟨https://docs.github.com/en/developers/apps/building-oauth-apps/scopes-for-oauth-apps/⟩.

# [OPTIONS](#OPTIONS)

[**-c**, **--clipboard**](#c)

Copy one-time OAuth device code to clipboard

[**--expiring**](#expiring)

Prefer expiring credentials that gh refreshes automatically, if the host supports them

[**-p**, **--git-protocol** **<string>**](#p)

The protocol to use for git operations on this host: {ssh|https}

[**-h**, **--hostname** **<string>**](#h)

The hostname of the GitHub instance to authenticate with

[**--insecure-storage**](#insecure_storage)

Save authentication credentials in plain text instead of credential store

[**-s**, **--scopes** **<strings>**](#s)

Additional authentication scopes to request

[**--skip-ssh-key**](#skip_ssh_key)

Skip generate/upload SSH key prompt

[**-w**, **--web**](#w)

Open a browser to authenticate

[**--with-token**](#with_token)

Read token from standard input

# [EXIT CODES](#EXIT_CODES)

0: Successful execution

1: Error

2: Command canceled

4: Authentication required

NOTE: Specific commands may have additional exit codes. Refer to the command's help for more information.

# [EXAMPLE](#EXAMPLE)

```
# Start interactive setup
$ gh auth login
# Open a browser to authenticate and copy one-time OAuth code to clipboard
$ gh auth login --web --clipboard
# Authenticate against github.com by reading the token from a file
$ gh auth login --with-token < mytoken.txt
# Authenticate with specific host
$ gh auth login --hostname enterprise.internal
```

# [SEE ALSO](#SEE_ALSO)

[**gh-auth(1)**](/man/os/gh/gh-auth.1)

Oct 2026

---

Document: gh-auth-login(1) from gh 2.103.2-r0 (Chainguard OS)
Source: https://github.com/cli/cli