How to Fix Git Authentication Failed in Termux (Android)

A real git authentication failure on mobile, traced in seconds once git remote -v revealed a token hardcoded into the remote URL.

Git authentication errors are annoying on a laptop. On a phone, with no local file browser and no GUI credential manager, they take longer to diagnose because you can't just glance at a settings panel. Here's an actual sequence of failures and how each one got isolated, using nothing but Termux and Chrome.

The first wall: "Invalid username or token"

A git push failed immediately with:

remote: Invalid username or token. Password authentication is not supported for Git operations.
fatal: Authentication failed for 'https://github.com/...'

The first instinct is to assume the Personal Access Token itself is wrong or expired. But before touching the token, the actual diagnostic step is checking whether git even *asked* for credentials interactively:

git config --list | grep credential

No credential helper was configured — so nothing was silently reusing a cached, wrong password. That ruled out one entire category of cause.

The second wall: no visible username/password prompt

On a second attempt, the push failed again with the exact same error, but the terminal scrollback showed no Username for... or Password for... prompt lines before the failure. That's the signal to stop suspecting the token and start suspecting the remote URL itself:

git remote -v

This is the step that actually found it:

origin  https://shabellehub-sudo:ghp_abc123@github.com/shabellehub-sudo/shabellehub.git (fetch)

The remote URL had a placeholder token embedded directly in it — ghp_abc123 — left over from an earlier setup step. Git was silently trying to authenticate with that fake, hardcoded token every time, and never prompting for real credentials at all, because as far as git was concerned, credentials were already "provided" in the URL.

The fix

git remote set-url origin https://github.com/shabellehub-sudo/shabellehub.git

Stripping the credentials out of the URL and back to a clean HTTPS remote restored the normal interactive prompt. The very next git push asked for a username and password properly, and a correctly-copied token from that point worked immediately.

A second, unrelated failure: divergent branches

On a different day, checking out main produced:

Your branch and 'origin/main' have diverged,
and have 1 and 4 different commits each, respectively.

This one had a genuinely different cause: a separate tool (a Claude Code session, running independently of this phone-only workflow) had committed directly to main on GitHub, while a local commit existed on the phone that had never been pushed. Two histories, same branch name, no shared latest commit.

The safe resolution — since the local commit added nothing of value on its own — was:

git checkout main
git reset --hard origin/main

That discards the local-only commit and realigns main exactly with what's on GitHub. This is not the right move if your local commit has changes you actually need — in that case the correct path is cherry-picking the specific commit onto a fresh branch off the updated main, not a hard reset. Knowing which situation you're in requires actually reading git log --oneline on both sides before resetting anything, not just running the command that fixed it last time.

Why this matters for mobile-only workflows specifically

None of these bugs are unique to phones. But on a desktop, a credential manager UI or a Git GUI client often surfaces "hey, this remote has embedded credentials" or "these branches have diverged" more visibly than a raw terminal does. On a phone, in a text-only terminal app, every one of these has to be diagnosed from git status, git log, and git remote -v output alone — which makes it worth memorizing that sequence as a first move, rather than guessing at fixes based on the error message alone.

Frequently Asked Questions

What does 'Invalid username or token' mean when git never even prompted for credentials?

It usually means the remote URL itself already has credentials embedded in it — check with git remote -v. Git will keep silently trying those embedded, possibly wrong or placeholder, credentials instead of prompting you at all.

How do you remove a hardcoded token from a git remote URL?

git remote set-url origin https://github.com/user/repo.git — replacing the URL with a clean version restores the normal interactive username/password prompt on the next push.

What does 'Your branch and origin/main have diverged' actually mean?

Your local branch and the remote branch each have commits the other doesn't — usually because something else (another tool, another session) pushed directly to the remote while you had unpushed local commits.

Is git reset --hard origin/main always the safe fix for diverged branches?

Only if your local-only commits aren't needed. It discards them permanently. If they matter, the correct move is cherry-picking those specific commits onto a fresh branch off the updated main instead.

📬 Get the latest AI tool reviews

Expert picks and comparisons, weekly. No spam.