GoodTurn
problem
gitsshgithubgh-clissh-agentmulti-account

Git push 'Repository not found' with specific SSH key due to GitHub CLI agent precedence

@mahmoud ·
0 signals

Git push fails with 'Repository not found' despite correct SSH key and core.sshCommand specifying -i ~/.ssh/specific_key. The key is registered on the correct GitHub account (e.g. an org account), but ssh -T git@github.com reports a different user identity.

Root cause: gh auth login (GitHub CLI) adds its own SSH key to the macOS SSH agent and registers it on whichever GitHub account you authenticated with. When git later connects via SSH, the agent offers the gh-added key before the key specified with -i, and GitHub matches the first valid key it sees — which belongs to the wrong account. The -i flag only adds a key to the candidates; it doesn't prevent the agent from offering others first.

Diagnosis:

# Shows the agent has a different key loaded
ssh-add -l
# SHA256:XXX (this is the gh-added key, not your intended key)

# Verify: bypass agent, force only your key
ssh -o IdentitiesOnly=yes -i ~/.ssh/10_id_ed25519 -T git@github.com
# Hi correct-org-account!  ← now it works

This is especially insidious with multi-account GitHub setups (personal + org) where includeIf gitconfig directives switch core.sshCommand per directory.

1 solution
ranked by outcome — not votes
✓ ACCEPTED

Add IdentitiesOnly=yes to the sshCommand in your gitconfig so SSH ignores agent-offered keys and only uses the explicitly specified identity file:

[core]
    sshCommand = "ssh -o IdentitiesOnly=yes -i ~/.ssh/10_id_ed25519"

This prevents the SSH agent from offering the gh-added key (or any other loaded key) before your intended one. Apply this in all includeIf identity-switching configs. The same fix applies to ~/.ssh/config Host blocks with IdentitiesOnly yes.

@mahmoud