Introduction

When you have multiple GitHub (or GitLab/Bitbucket) accounts, such as a work account and a personal account, the default git clone command authenticates with whichever credential is cached on your system. This means cloning a repo with the wrong account silently succeeds for public repos but fails for private ones, and pushes always go out under the wrong identity. Learning how to explicitly control which account is used for each clone saves you from permission errors and mis-attributed commits.

Embedding the Username in the HTTPS URL

The quickest way to clone with a specific account is to include the username directly in the URL:

git clone https://[email protected]/org/private-repo.git

Git will prompt you for the password or personal access token (PAT) for work-user. This overrides whatever default credential is stored in your system's credential manager.

For GitHub specifically, password authentication is no longer supported. You need to use a PAT as the password:

git clone https://[email protected]/org/private-repo.git
# When prompted for password, paste your PAT

You can also embed the token directly (useful for CI, but avoid this in shell history on shared machines):

git clone https://work-user:[email protected]/org/private-repo.git

SSH Config with Multiple Keys

SSH is the preferred method for managing multiple accounts because you can assign a different key to each account without entering credentials repeatedly. The trick is to create host aliases in your ~/.ssh/config file.

First, generate separate keys for each account:

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_work -C "[email protected]"
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_personal -C "[email protected]"

Then configure host aliases in ~/.ssh/config:

1# Work account
2Host github-work
3  HostName github.com
4  User git
5  IdentityFile ~/.ssh/id_ed25519_work
6  IdentitiesOnly yes
7
8# Personal account
9Host github-personal
10  HostName github.com
11  User git
12  IdentityFile ~/.ssh/id_ed25519_personal
13  IdentitiesOnly yes

Now clone using the alias instead of github.com:

1# Clone with work account
2git clone git@github-work:org/private-repo.git
3
4# Clone with personal account
5git clone git@github-personal:myuser/my-project.git

The IdentitiesOnly yes directive is important. Without it, the SSH agent may offer other keys first, and GitHub accepts whichever key matches first regardless of which account you intended.

Using GIT_SSH_COMMAND

For a one-off clone with a specific SSH key without modifying your SSH config, use the GIT_SSH_COMMAND environment variable:

GIT_SSH_COMMAND="ssh -i ~/.ssh/id_ed25519_work -o IdentitiesOnly=yes" \
  git clone [email protected]:org/private-repo.git

To make this persistent for a specific repository after cloning:

cd private-repo
git config core.sshCommand "ssh -i ~/.ssh/id_ed25519_work -o IdentitiesOnly=yes"

Git Credential Helpers

Git credential helpers cache or store your HTTPS credentials. The problem with multiple accounts is that the default helpers store one credential per host. When you need two GitHub accounts over HTTPS, you need a credential helper that can distinguish them.

On macOS, the osxkeychain helper stores credentials per URL, including the username:

git config --global credential.helper osxkeychain

On Linux, you can use the store helper with a custom file per account, or use the credential.useHttpPath option to differentiate by repository path:

git config --global credential.useHttpPath true

This tells Git to store separate credentials for github.com/work-org/repo and github.com/personal/repo instead of sharing one credential for all of github.com.

GitHub Personal Access Tokens (PATs)

GitHub PATs replace passwords for HTTPS authentication. You can create fine-grained tokens scoped to specific repositories, which is ideal for multi-account setups.

Create a PAT at GitHub Settings then use it:

git clone https://github.com/org/repo.git
# Username: your-work-username
# Password: ghp_yourWorkPAT

For automation or scripts, set the token in the remote URL:

git remote set-url origin https://work-user:[email protected]/org/repo.git

Setting Per-Repo Author Identity

Cloning with the right account handles authentication, but you also need the correct author identity on commits. Set it per repository:

cd private-repo
git config user.name "Work Name"
git config user.email "[email protected]"

Or use conditional includes in ~/.gitconfig to automate this based on directory:

1[includeIf "gitdir:~/work/"]
2  path = ~/.gitconfig-work
3
4[includeIf "gitdir:~/personal/"]
5  path = ~/.gitconfig-personal

Then in ~/.gitconfig-work:

[user]
  name = Work Name
  email = [email protected]

Common Pitfalls

• Forgetting IdentitiesOnly yes in SSH config, which lets the SSH agent offer the wrong key and authenticate as the wrong account
• Storing a PAT in the clone URL in your shell history, exposing it to anyone with access to the machine
• Setting user.name and user.email globally instead of per-repo, causing commits to be attributed to the wrong account
• Not enabling credential.useHttpPath when using HTTPS with multiple accounts on the same host, causing credentials to collide
• Cloning with HTTPS when your PAT has expired, then troubleshooting SSH config when the real problem is token rotation

Summary

• Embed the username in the HTTPS URL (https://[email protected]/...) for quick one-off clones with a specific account
• Use SSH host aliases in ~/.ssh/config with separate keys for each account as the most reliable multi-account setup
• Set IdentitiesOnly yes in SSH config to prevent the agent from offering the wrong key
• Use GIT_SSH_COMMAND for one-off clones without modifying SSH config
• Enable credential.useHttpPath when using HTTPS credential helpers with multiple accounts on the same host
• Always set user.name and user.email per repository or use conditional includes to avoid mis-attributed commits