GitLab "HTTP Basic: Access denied": why Git rejects you, and how to fix it

git clone, git pull or git push over HTTPS stops, and Git prints this:

remote: HTTP Basic: Access denied. If a password was provided for Git authentication, the password was incorrect or you're required to use a token instead of a password. If a token was provided, it was either incorrect, expired, or improperly scoped. See https://gitlab.com/help/topics/git/troubleshooting_git.md#error-on-git-fetch-http-basic-access-denied
fatal: Authentication failed for 'https://gitlab.com/group/project.git/'

GitLab got a username and password from Git and accepted neither. Here is what causes it in GitLab 19.5, how to fix each cause, and the errors that look like it but mean something else.

Why GitLab denies access

Git sent a password, and GitLab wants a token. A password doesn’t work for Git over HTTPS when:

• two-factor authentication is on for your account, or enforced for you;
• you use GitLab.com: since April 2026 it requires multi-factor authentication for every password sign-in, so a password no longer works for Git there;
• you sign in with SSO or SAML, whose users can’t use a password for Git;
• an administrator cleared Allow password authentication for Git over HTTP(S) on GitLab Self-Managed;
• or the password is wrong.

Git sent a token, and GitLab can’t use it. It’s mistyped, it expired at midnight UTC on its expiry date, or it was revoked. Rotating a token revokes the old one at once, so a rotated token counts. The account that owns it can also be the problem: see still denied below.

Despite the message’s last words, a token with the wrong scope usually gets past this point and fails with a different error, listed further down.

Fix it with a token

1. Create a personal access token: select your avatar, then Edit profile › Access › Personal access tokens, and Generate token › Legacy token. Give it a name and an expiry date, and select write_repository, or read_repository if you only clone and pull. Copy it now: GitLab shows it once.
2. Run the Git command again. When Git asks, enter your GitLab username, and paste the token as the password.
3. If you use a credential helper, it saves the token, and Git won’t ask again until the token stops working.

A shortcut for step 1: https://gitlab.com/-/user_settings/personal_access_tokens?name=Git&scopes=write_repository opens the form with the name and scope filled in. On your own instance, use its address.

GitLab’s docs also show the token inside the URL, as in git clone https://oauth2:<token>@gitlab.com/group/project.git. It works, but Git then keeps the token in plain text in the repository’s .git/config.

Two ways to skip tokens:

• An OAuth credential helper. Git Credential Manager, included with Git for Windows, and git-credential-oauth sign you in through the browser, two-factor authentication included. Both work with GitLab.com without setup; GitLab Self-Managed needs a little configuration.
• SSH. With an SSH key on your account, git@gitlab.com:group/project.git remotes use neither passwords nor tokens. GitLab’s notice about mandatory MFA calls SSH the preferred method.

Clear the old credentials

If Git fails again without asking for anything, it’s still sending the old credentials.

From the remote URL. git remote -v shows it. If it holds a token or password, as in https://oauth2:glpat-…@gitlab.com/…, set a clean one:

git remote set-url origin https://gitlab.com/group/project.git

From your credential helper. Tell it to forget what it saved for GitLab:

printf 'protocol=https\nhost=gitlab.com\n\n' | git credential reject

It works with whichever helper Git uses: Keychain on macOS, Git Credential Manager on Windows, store or cache on Linux. The next Git command asks again.

On Windows, with Git for Windows 2.46.0 or later. An empty username can cause the error even with a valid token. Put your username in the URL:

git remote set-url origin https://<USERNAME>@gitlab.com/group/project.git

Which token, which username

GitLab ignores the username for personal, project and group access tokens, but checks it for deploy tokens and CI/CD job tokens.

Token	Username	Can
Personal access token	Any non-empty value, such as your username	Clone and pull with read_repository; push with write_repository or api
Fine-grained personal access token (GitLab 19.2 and later)	Any non-empty value	Clone and pull with Code: Download; push with Code: Push, for projects inside its boundary
Project or group access token	Any non-empty value	The same scopes, limited by the role the token was given
Deploy token	Its own: gitlab+deploy-token-<n>, unless you chose one	Clone and pull only, with read_repository
CI/CD job token	gitlab-ci-token, with $CI_JOB_TOKEN as the password	Clone the projects the job may access; push only to a project with Allow Git push requests to the repository turned on

Which scopes to give a token, and why: GitLab token scopes explained.

Errors that look like it

These come after GitLab accepted your credentials, or before it checked them. Git ends most of them with The requested URL returned error: 403.

Git prints	It means	Fix
remote: You are not allowed to download code.	The token has no scope for Git, like a read_user token.	A token with read_repository, write_repository or api.
remote: You are not allowed to upload code.	The token can read but not push: read_repository, or a deploy token.	A token with write_repository or api.
remote: You are not allowed to push code to this project.	Your role can’t push, such as Reporter.	Ask for the Developer role, or fork and open a merge request.
remote: GitLab: You are not allowed to push code to protected branches on this project.	The branch is protected.	See not allowed to push to a protected branch.
remote: The project you were looking for could not be found or you don't have permission to view it.	The path is wrong, or the token’s owner can’t see the project.	Check the URL, and that the account is a member.
remote: Too many failed authentication attempts from this IP	Too many failed sign-ins from your IP address: GitLab bans it for a while.	Fix the credentials, then wait.

The ban counts Git and container registry sign-ins together. On GitLab.com, 300 failures in one minute from one IP address block it for 15 minutes. On GitLab Self-Managed the ban is off by default, and when an administrator turns it on, by default 10 failures in a minute block an address for an hour. While it lasts, even correct credentials get a 403, so stop the script or tool that keeps retrying first.

Still denied with a good token?

• Your password expired. On GitLab Self-Managed, when an administrator sets or changes your password, you must change it at your next sign-in. Until you do, Git over HTTPS refuses your tokens too. Sign in to GitLab in a browser and set a new password.
• The account is blocked. A blocked account can’t use Git with any credentials. Ask your administrator.
• Your group enforces SSO for Git (GitLab.com). With Enforce SSO-only authentication for Git and Dependency Proxy activity for this group turned on, you need an active SSO session, on any device, before you can pull or push. Sign in through the group’s SSO in a browser, then try again.

On your phone

On gitlab.com, MergeBell signs in on GitLab’s own page; on a self-managed GitLab, it uses a personal access token with the api scope. Either way the sign-in stays on your phone, so Git on your computer needs a token of its own. When MergeBell uses a token, Settings shows its expiry date, and from a week before, the app warns in the inbox and in Settings, with New token to open GitLab’s token page with the name and the api scope filled in. How expiry, rotation and the warning emails work: GitLab token expired? How to rotate a personal access token.