# Invalid username or password error 128 when connecting to private GitHub repo

**URL:** <https://community.jenkins.io/t/invalid-username-or-password-error-128-when-connecting-to-private-github-repo/12753>\
**Category:** Ask a question\
**Tags:** pipeline\
**Created:** [February 26, 2024, 12:32am UTC](https://community.jenkins.io/t/invalid-username-or-password-error-128-when-connecting-to-private-github-repo/12753 "2024-02-26T00:32:31Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![lgiff](https://avatars.discourse-cdn.com/v4/letter/l/e274bd/32.png) [@lgiff](https://community.jenkins.io/u/lgiff)\
**Post date:** [February 26, 2024, 12:32am UTC](https://community.jenkins.io/t/invalid-username-or-password-error-128-when-connecting-to-private-github-repo/12753/1 "2024-02-26T00:32:31Z")

</div>

Hello, I hope this is the correct place to ask my question and that I can get some help from the community. I have an intermittent issue and can’t pinpoint where the issues is.

In short, I’m running a few multi-branch pipelines that are activated via a WebHook from GitHub. I have configured a GitHub App, which activates the WebHook for the connected projects. In Jenkins, I have added the necessary credentials and everything works great…then it doesn’t.

Every now and then I get an “Invalid username or password” error with a status code of 128. The interesting thing is (and you’ll see this in the logs below) that the connection to GitHub is fine because it successfully downloads the Jenkinsfiles. When it does fail, I can immediately re-run the job and it works perfectly. This will continue to work perfectly until a few hours later when it will fail again. This more often than not fails on new branches. I created a test app in GitHub and hooked it up to Jenkins and it failed. Here is the output from the log (I have redacted some info I believe to be private with \*\*\*\*\*):

```auto
Push event to branch main
11:04:31 Connecting to https://api.github.com using ******/****** (GitHub App: jenkins-app-credentials)
Obtained Jenkinsfile from *****
[Pipeline] Start of Pipeline
[Pipeline] node
Running on ***** in E:\tools\jenkins-agent\workspace\Test_Multibranch_Pipeline_main
[Pipeline] {
[Pipeline] stage
[Pipeline] { (Declarative: Checkout SCM)
[Pipeline] checkout
The recommended git tool is: NONE
using credential jenkins-app-credentials
Cloning the remote Git repository
Cloning with configured refspecs honoured and without tags
Cloning repository https://github.com/ ***** /TestRepo.git
 > git.exe init E:\tools\jenkins-agent\workspace\Test_Multibranch_Pipeline_main # timeout=10
Fetching upstream changes from https://github.com/ ***** /TestRepo.git
 > git.exe --version # timeout=10
 > git --version # 'git version 2.43.0.windows.1'
using GIT_ASKPASS to set credentials GitHub App: jenkins-app-credentials
 > git.exe fetch --no-tags --force --progress -- https://github.com/ ***** /TestRepo.git +refs/heads/main:refs/remotes/origin/main # timeout=10
ERROR: Error cloning remote repo 'origin'
hudson.plugins.git.GitException: Command "git.exe fetch --no-tags --force --progress -- https://github.com/ ***** /TestRepo.git +refs/heads/main:refs/remotes/origin/main" returned status code 128:
stdout: 
stderr: remote: Invalid username or password.
fatal: Authentication failed for 'https://github.com/ ***** /TestRepo.git/'

	at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandIn(CliGitAPIImpl.java:2842)
	at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandWithCredentials(CliGitAPIImpl.java:2185)
	at org.jenkinsci.plugins.gitclient.CliGitAPIImpl$1.execute(CliGitAPIImpl.java:635)
	at org.jenkinsci.plugins.gitclient.CliGitAPIImpl$2.execute(CliGitAPIImpl.java:871)
	at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler$GitCommandMasterToSlaveCallable.call(RemoteGitImpl.java:170)
	at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler$GitCommandMasterToSlaveCallable.call(RemoteGitImpl.java:161)
	at hudson.remoting.UserRequest.perform(UserRequest.java:211)
	at hudson.remoting.UserRequest.perform(UserRequest.java:54)
	at hudson.remoting.Request$2.run(Request.java:377)
	at hudson.remoting.InterceptingExecutorService.lambda$wrap$0(InterceptingExecutorService.java:78)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
	at hudson.remoting.Engine$1.lambda$newThread$0(Engine.java:125)
	at java.base/java.lang.Thread.run(Thread.java:842)
	Suppressed: hudson.remoting.Channel$CallSiteStackTrace: Remote call to web-test-104
		at hudson.remoting.Channel.attachCallSiteStackTrace(Channel.java:1787)
		at hudson.remoting.UserRequest$ExceptionResponse.retrieve(UserRequest.java:356)
		at hudson.remoting.Channel.call(Channel.java:1003)
		at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler.execute(RemoteGitImpl.java:153)
		at jdk.internal.reflect.GeneratedMethodAccessor762.invoke(Unknown Source)
		at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
		at java.base/java.lang.reflect.Method.invoke(Method.java:568)
		at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler.invoke(RemoteGitImpl.java:138)
		at jdk.proxy52/jdk.proxy52.$Proxy143.execute(Unknown Source)
		at hudson.plugins.git.GitSCM.retrieveChanges(GitSCM.java:1222)
		at hudson.plugins.git.GitSCM.checkout(GitSCM.java:1305)
		at org.jenkinsci.plugins.workflow.steps.scm.SCMStep.checkout(SCMStep.java:129)
		at org.jenkinsci.plugins.workflow.steps.scm.SCMStep$StepExecutionImpl.run(SCMStep.java:97)
		at org.jenkinsci.plugins.workflow.steps.scm.SCMStep$StepExecutionImpl.run(SCMStep.java:84)
		at org.jenkinsci.plugins.workflow.steps.SynchronousNonBlockingStepExecution.lambda$start$0(SynchronousNonBlockingStepExecution.java:47)
		at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
		at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
		at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
		at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
		... 1 more
[Pipeline] }
[Pipeline] // stage
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline
ERROR: Error cloning remote repo 'origin'

GitHub has been notified of this commit’s build result

Finished: FAILURE

```

As you can see from the above log, it has successfully downloaded the Jenkinsfile, however I get an “Invalid username or password” and the rest fails.

I’m not sure if this is relevant or will help but I’ve included below the contents of my Jenkinsfile. You can see from the logs that it hasn’t even processed the “Init” stage, given I can’t see any “Init started” in the log.

```auto
pipeline {
    agent any
    options {
        buildDiscarder logRotator(artifactDaysToKeepStr: '', artifactNumToKeepStr: '5', daysToKeepStr: '', numToKeepStr: '5')
        disableConcurrentBuilds();
    }
    stages {
        stage('Init') {
            steps {
                script {
                    println "Init started"
                    def currentDirectory = pwd()
                    println "Current working directory: ${currentDirectory}"
                    def branchName = env.GIT_BRANCH
                    println "Current branch name: ${branchName}"
                }
            }
        }
        stage('Checkout') {
            steps {
                // Check out your source code from the GitHub repository
                checkout([$class: 'GitSCM', branches: [[name: env.GIT_BRANCH]], doGenerateSubmoduleConfigurations: false, extensions: [], userRemoteConfigs: [[url: 'https://github.com/Auto-IT-Australia/TestRepo', credentialsId: 'jenkins-auto-it-australia']]])
            }
        }
    }
}

```

I’m very confused as to why this is failing and have no idea even where to start looking. Any help you can provide will be valuable and very much appreciated.

Jenkins setup:

## Jenkins: 2.426.3 OS: Windows Server 2022 - 10.0 Java: 17.0.9 - Oracle Corporation (Java HotSpot™ 64-Bit Server VM)

ant:497.v94e7d9fffa\_b\_9  
antisamy-markup-formatter:162.v0e6ec0fcfcf6  
apache-httpcomponents-client-4-api:4.5.14-208.v438351942757  
bootstrap5-api:5.3.2-3  
bouncycastle-api:2.30.1.77-225.v26ea\_c9455fd9  
branch-api:2.1148.vce12cfcdf090  
build-timeout:1.32  
caffeine-api:3.1.8-133.v17b\_1ff2e0599  
checks-api:2.0.2  
cloudbees-folder:6.858.v898218f3609d  
commons-lang3-api:3.13.0-62.v7d18e55f51e2  
commons-text-api:1.11.0-95.v22a\_d30ee5d36  
credentials:1319.v7eb\_51b\_3a\_c97b\_  
credentials-binding:657.v2b\_19db\_7d6e6d  
display-url-api:2.200.vb\_9327d658781  
durable-task:550.v0930093c4b\_a\_6  
echarts-api:5.4.3-2  
email-ext:2.104  
font-awesome-api:6.5.1-2  
git:5.2.1  
git-client:4.6.0  
github:1.38.0  
github-api:1.318-461.v7a\_c09c9fa\_d63  
github-branch-source:1772.va\_69eda\_d018d4  
gradle:2.10  
gson-api:2.10.1-15.v0d99f670e0a\_7  
instance-identity:185.v303dc7c645f9  
ionicons-api:56.v1b\_1c8c49374e  
jackson2-api:2.16.1-373.ve709c6871598  
jakarta-activation-api:2.0.1-3  
jakarta-mail-api:2.0.1-3  
javax-activation-api:1.2.0-6  
javax-mail-api:1.6.2-9  
jaxb:2.3.9-1  
jjwt-api:0.11.5-77.v646c772fddb\_0  
joda-time-api:2.12.7-29.v5a\_b\_e3a\_82269a\_  
jquery3-api:3.7.1-1  
json-path-api:2.9.0-33.v2527142f2e1d  
junit:1259.v65ffcef24a\_88  
ldap:711.vb\_d1a\_491714dc  
mailer:463.vedf8358e006b\_  
matrix-auth:3.2.1  
matrix-project:822.824.v14451b\_c0fd42  
mina-sshd-api-common:2.12.0-90.v9f7fb\_9fa\_3d3b\_  
mina-sshd-api-core:2.12.0-90.v9f7fb\_9fa\_3d3b\_  
okhttp-api:4.11.0-172.vda\_da\_1feeb\_c6e  
pam-auth:1.10  
pipeline-build-step:540.vb\_e8849e1a\_b\_d8  
pipeline-github-lib:42.v0739460cda\_c4  
pipeline-graph-analysis:202.va\_d268e64deb\_3  
pipeline-groovy-lib:704.vc58b\_8890a\_384  
pipeline-input-step:477.v339683a\_8d55e  
pipeline-milestone-step:111.v449306f708b\_7  
pipeline-model-api:2.2175.v76a\_fff0a\_2618  
pipeline-model-definition:2.2175.v76a\_fff0a\_2618  
pipeline-model-extensions:2.2175.v76a\_fff0a\_2618  
pipeline-rest-api:2.34  
pipeline-stage-step:305.ve96d0205c1c6  
pipeline-stage-tags-metadata:2.2175.v76a\_fff0a\_2618  
pipeline-stage-view:2.34  
pipeline-utility-steps:2.16.2  
plain-credentials:143.v1b\_df8b\_d3b\_e48  
plugin-util-api:3.8.0  
resource-disposer:0.23  
scm-api:683.vb\_16722fb\_b\_80b\_  
script-security:1326.vdb\_c154de8669  
snakeyaml-api:2.2-111.vc6598e30cc65  
ssh-credentials:308.ve4497b\_ccd8f4  
ssh-slaves:2.948.vb\_8050d697fec  
structs:337.v1b\_04ea\_4df7c8  
timestamper:1.26  
token-macro:400.v35420b\_922dcb\_  
trilead-api:2.133.vfb\_8a\_7b\_9c5dd1  
variant:60.v7290fc0eb\_b\_cd  
workflow-aggregator:596.v8c21c963d92d  
workflow-api:1291.v51fd2a\_625da\_7  
workflow-basic-steps:1042.ve7b\_140c4a\_e0c  
workflow-cps:3867.v535458ce43fd  
workflow-durable-task-step:1331.vc8c2fed35334  
workflow-job:1385.vb\_58b\_86ea\_fff1  
workflow-multibranch:773.vc4fe1378f1d5  
workflow-scm-step:415.v434365564324  
workflow-step-api:657.v03b\_e8115821b\_  
workflow-support:865.v43e78cc44e0d  
ws-cleanup:0.45

---

<div class="post-metadata">

**Author:** ![poddingue](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/poddingue/32/985_2.png) [@poddingue](https://community.jenkins.io/u/poddingue)\
**Post date:** [February 26, 2024, 9:24am UTC](https://community.jenkins.io/t/invalid-username-or-password-error-128-when-connecting-to-private-github-repo/12753/2 "2024-02-26T09:24:02Z")

</div>

Hello @lgiff and welcome to this community. 👋

I don’t see anything in your setup that could be the cause of the issue you’re facing. 🤔  
There might be a network issue that is causing intermittent failures. You could check the network logs to see if there are any connectivity issues. 🤷

---

<div class="post-metadata">

**Author:** ![lgiff](https://avatars.discourse-cdn.com/v4/letter/l/e274bd/32.png) [@lgiff](https://community.jenkins.io/u/lgiff)\
**Post date:** [February 27, 2024, 2:00am UTC](https://community.jenkins.io/t/invalid-username-or-password-error-128-when-connecting-to-private-github-repo/12753/3 "2024-02-27T02:00:51Z")

</div>

Good suggestion, it could be network related, but I would have expected a different error such as a timeout. This node is running on an older server so I will set up another node on a different network to see if that at least solves the issue. If the new node doesn’t have any issues, that’ll mean it’s likely a network issue or something to do with the node itself.

---

<div class="post-metadata">

**Author:** ![lgiff](https://avatars.discourse-cdn.com/v4/letter/l/e274bd/32.png) [@lgiff](https://community.jenkins.io/u/lgiff)\
**Post date:** [February 27, 2024, 11:20pm UTC](https://community.jenkins.io/t/invalid-username-or-password-error-128-when-connecting-to-private-github-repo/12753/4 "2024-02-27T23:20:20Z")

</div>

FYI - I set up a new node and couldn’t get it to fail. I don’t know however if this is just a coincidence or the node is working better. I set up Wireshark on the node that is failing intermittently and it started working, without fail, every single time!! Even if it did fail, I don’t know anything about how to analyze a Wireshark log anyway.

The thing about the failing build is that it is failing before it runs the Jenkinsfile script. This is the process of the pipeline where it checks out the code from GitHub. Unfortunately, there doesn’t seem to be any options to retry on fail or extend the timeout from the default 10 seconds. **If anyone knows how retry the checkout on fail, please let me know.** I have a feeling this might be an issue with the multi-branch pipeline plugin but it’s difficult to prove when I can’t consistently get the build to fail.

I might have to get our IT to build a new server for me, but will be embarrassing if it continues to fail on the new server.

---

<div class="post-metadata">

**Author:** ![MarcelSpaceform](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/marcelspaceform/32/7701_2.png) [@MarcelSpaceform](https://community.jenkins.io/u/MarcelSpaceform)\
**Post date:** [April 4, 2024, 8:12am UTC](https://community.jenkins.io/t/invalid-username-or-password-error-128-when-connecting-to-private-github-repo/12753/5 "2024-04-04T08:12:33Z")

</div>

I have been experiencing the exact same issue and scenario.  
Having the checkout retry should be an option. This plugin has no fallback options if it fails

---

<div class="post-metadata">

**Author:** ![lgiff](https://avatars.discourse-cdn.com/v4/letter/l/e274bd/32.png) [@lgiff](https://community.jenkins.io/u/lgiff)\
**Post date:** [April 4, 2024, 12:51pm UTC](https://community.jenkins.io/t/invalid-username-or-password-error-128-when-connecting-to-private-github-repo/12753/6 "2024-04-04T12:51:09Z")

</div>

I’ve given up finding a solution. My workaround is email notifications if it fails so at least I can kick off a retry manually.

---

<div class="post-metadata">

**Author:** ![dzianis](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@dzianis](https://community.jenkins.io/u/dzianis)\
**Post date:** [March 14, 2025, 10:03am UTC](https://community.jenkins.io/t/invalid-username-or-password-error-128-when-connecting-to-private-github-repo/12753/7 "2025-03-14T10:03:05Z")

</div>

Do you find another solution?

I have a better workaround. In my case I’m running simple job with echo twice per hour to renew token (1,2 \* \* \* \*). This job fail once, update the token and second time work without problems. In that case I have updated token most of the time.

Maybe there is some permanent solution?

---

<div class="post-metadata">

**Author:** ![dzianis](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@dzianis](https://community.jenkins.io/u/dzianis)\
**Post date:** [March 28, 2025, 9:10am UTC](https://community.jenkins.io/t/invalid-username-or-password-error-128-when-connecting-to-private-github-repo/12753/8 "2025-03-28T09:10:03Z")

</div>

The permanent solution for me was:  
Go to the windows node and change default gitconfig file. It is located inside C:\Program Files\Git\etc\gitconfig  
I just comment [credential] section and it is helps. Most probably windows node cached the token and try to reuse it next time.  
If you have more information feel free to share!

---

<div class="post-metadata">

**Author:** ![alansparks](https://avatars.discourse-cdn.com/v4/letter/a/839c29/32.png) [@alansparks](https://community.jenkins.io/u/alansparks)\
**Post date:** [March 26, 2026, 12:06am UTC](https://community.jenkins.io/t/invalid-username-or-password-error-128-when-connecting-to-private-github-repo/12753/9 "2026-03-26T00:06:38Z")

</div>

Reviving this thread since we’re getting hit by this on new builds daily. I see a lot of people have this issue but there’s no reliable solution I can find. Is there newer information on this? As everyone, I have a Github App credential that works fine, but jobs occasionally fail with the “stderr: remote: Invalid username or token. Password authentication is not supported for Git operations.” error.

---

<div class="post-metadata">

**Author:** ![pmcnamee\_sym](https://avatars.discourse-cdn.com/v4/letter/p/4bbf92/32.png) [@pmcnamee\_sym](https://community.jenkins.io/u/pmcnamee_sym)\
**Post date:** [April 20, 2026, 5:36pm UTC](https://community.jenkins.io/t/invalid-username-or-password-error-128-when-connecting-to-private-github-repo/12753/10 "2026-04-20T17:36:05Z")

</div>

Using GitHub app in this manner for the first time. Also seeing this. I know to use an app outside of Jenkins, you need to manage a generated temp token. I suspect that is all handled under the covers by Jenkins. I am guessing there is latency somewhere. The token isn’t coming back fast enough before Jenkins tries to use it. Or maybe the previous temp token is cached and mistakenly tried first?

---

<div class="post-metadata">

**Author:** ![pmcnamee\_sym](https://avatars.discourse-cdn.com/v4/letter/p/4bbf92/32.png) [@pmcnamee\_sym](https://community.jenkins.io/u/pmcnamee_sym)\
**Post date:** [April 21, 2026, 12:56pm UTC](https://community.jenkins.io/t/invalid-username-or-password-error-128-when-connecting-to-private-github-repo/12753/11 "2026-04-21T12:56:45Z")

</div>

FWIW - we found in our case, there was a definite pattern of failure after an idle time - e.g.; one hour. We saw this in both freestyle and declarative pipeline. This led us to believe there is a token cached and reused the first time, after its expiration.  
In declarative pipeline, we used a try/catch, the catch attempts the checkout again. This seems to work. Ugly workaround and not a fix.  
Still unsure what to do for a freestyle build.  
Our scripted pipelines did not seem to run into this.

---

<div class="post-metadata">

**Author:** ![pmcnamee\_sym](https://avatars.discourse-cdn.com/v4/letter/p/4bbf92/32.png) [@pmcnamee\_sym](https://community.jenkins.io/u/pmcnamee_sym)\
**Post date:** [May 14, 2026, 12:23pm UTC](https://community.jenkins.io/t/invalid-username-or-password-error-128-when-connecting-to-private-github-repo/12753/12 "2026-05-14T12:23:08Z")

</div>

FYI:

> <https://github.com/jenkinsci/github-branch-source-plugin/issues/1515>
>
> \### Jenkins and plugins versions report
> 
> \<details\>
> \<summary\>Environment\</summa…ry\>
> 
>   
> \`\`\`text
> - GitHub Branch Source Plugin: \[1917.v9ee8a\_39b\_3d0d\]
> \- Jenkins version: \[2.541.3\]
> \- Agent OS: Windows (static/permanent node)
> \- Git version: 2.51.0.windows.2
> \`\`\`\\
> \</details\>
> 
> 
> \### What Operating System are you using (both controller, and any agents involved in the problem)?
> 
> Linux (GKE - Google Kubernetes Engine)
> Jenkins running as a containerized workload
> 
> Agents (where the problem occurs)
> Windows - static/permanent nodes
> Confirmed agent: jenkins-win
> Git version: 2.51.0.windows.2
> 
> Agents (where it works fine)
> Linux - dynamic/ephemeral agents
> Token refresh works correctly on these
> 
> \### Reproduction steps
> 
> 1. Configure a Jenkins job using GitHub App credential 
> (credential type: GitHub App) for SCM checkout via HTTPS
> 
> 2. Run the job successfully on a Windows static/permanent agent
> 
> 3. Wait approximately 1 hour without triggering another build 
> (allowing the GitHub App installation token to expire)
> 
> 4. Trigger the same job again on the same Windows static agent
> 
> 5. Observe build failure at SCM checkout stage
> 
> \### Expected Results
> 
> GitHub App installation token should be refreshed automatically before each build regardless of agent type or OS, consistent with the behaviour already working on Linux static agents (fixed in PR #291) and Linux ephemeral agents.
> 
> \### Actual Results
> 
> Build fails at SCM checkout with:
> 
> remote: Invalid username or token. 
> Password authentication is not supported for Git operations.
> fatal: Authentication failed for 'https://github.com/org/repo.git/'
> 
> The expired token is being cached in Windows Credential Manager via the GIT\_ASKPASS mechanism and reused on subsequent builds without 
> refresh. An immediate manual retry always succeeds because it forces a new token generation.
> 
> Build history showing consistent ~1hr failure pattern:
> Build 7 ✅ 1:19 PM (token generated)
> Build 14 ❌ 2:34 PM (~1hr 15min later - token expired)
> Build 15 ✅ 2:35 PM (immediate retry - fresh token)
> Build 16 ❌ 4:12 PM (~1hr 37min later - token expired again)
> Build 17 ✅ 4:12 PM (immediate retry - fresh token)
> 
> \### Anything else?
> 
> Root cause suspected:
> On Windows, GIT\_ASKPASS delegates credential handling to Windows Credential Manager which caches the token. Unlike Linux, the Windows 
> Credential Manager cache is not invalidated between builds, causing the stale expired token to be reused.
> 
> PR #291 fixed token refresh for Linux static nodes but the fix does not cover Windows agents where credential caching behaviour is fundamentally different.
> 
> Current workaround applied in Jenkinsfile:
> bat 'cmdkey /delete:LegacyGenericCredential:https://github.com || exit 0'
> bat 'cmdkey /delete:git:https://github.com || exit 0'
> 
> This clears the Windows Credential Manager cache before each checkout forcing Jenkins to generate a fresh token. This confirms the cached 
> credential is the root cause.
> 
> Reference: PR #291 - https://github.com/jenkinsci/github-branch-source-plugin/pull/291
> 
> \### Are you interested in contributing a fix?
> 
> Yes — the suspected fix would be in GitHubAppCredentials.java to add Windows-specific credential cache invalidation logic, mirroring what PR #291 did for Linux but accounting for the Windows Credential Manager behaviour differences with GIT\_ASKPASS.
> 
> Happy to work on a PR with guidance from maintainers on the preferred approach.

---

<div class="post-metadata">

**Author:** ![lgiff](https://avatars.discourse-cdn.com/v4/letter/l/e274bd/32.png) [@lgiff](https://community.jenkins.io/u/lgiff)\
**Post date:** [October 30, 2026, 10:41pm UTC](https://community.jenkins.io/t/invalid-username-or-password-error-128-when-connecting-to-private-github-repo/12753/13 "2026-10-30T22:41:10Z")

</div>

I might have a solution to this. I set my agent to do some work in Jenkins and during that process it hit the same issue a few times and decided on its own to go and fix the problem. I asked what it did to resolve the problem and this was its response:

Verified script for the stale GitHub token on a Jenkins Windows agent. Open Manage Jenkins, Nodes, pick the agent, then Script Console (the URL is /computer//script), paste this and run it:

```auto
def run = { c ->
  def p = \["cmd", "/c", c\].execute()
  def out = new StringBuffer(), err = new StringBuffer()
  p.waitForProcessOutput(out, err)
  println(out.toString() + err.toString())
}
run('git config --global credential.helper ""')
run("cmdkey /delete:git:https://github.com")
run("git config --show-origin --get-all credential.helper")
run("cmdkey /list | findstr /i github")

```

Problem solved? So far I haven’t hit the issue again 😉
