Access GitHub Repositories with SourceTree and 2FA (2 Factor Authentication)

Graphical Git clients can make common repository operations easier to visualize, particularly for developers who prefer not to perform every Git operation from the command line. SourceTree is one such client and can be configured to work with GitHub repositories.

When two-factor authentication (2FA) is enabled on a GitHub account, the authentication flow differs from a simple username-and-password configuration. This article documents the SourceTree configuration that was used when the article was originally written.

Version context: This is a historical workflow from 2017. GitHub no longer supports account-password authentication for Git operations over HTTPS. Current GitHub and SourceTree versions may use OAuth, personal access tokens, SSH keys, or other updated authentication flows. Treat the steps below as historical troubleshooting documentation rather than current GitHub setup guidance.

SourceTree Configuration Without 2FA

At the time this article was written, the basic SourceTree configuration on macOS was:

1. Open SourceTree → Preferences.
2. Select Accounts.
3. Click Add.
4. Select GitHub as the host.
5. Select Basic as the authentication type.
6. Enter the GitHub username.
7. Enter the GitHub password.
8. Select HTTPS as the protocol.
9. Save the account.

SourceTree Configuration With 2FA

For a GitHub account protected by 2FA, the historical workflow used a personal access token in place of the account password:

1. Sign in to GitHub and open Settings.
2. Open the personal access token settings.
3. Generate a token with only the scopes required for the intended repository operations.
4. Copy the token and store it securely. Tokens should be treated like passwords and must not be committed to source control or shared in documentation.
5. Open SourceTree → Preferences → Accounts.
6. Add a GitHub account.
7. Select Basic authentication and HTTPS.
8. Enter the GitHub username.
9. Use the generated token in the password/credential field.
10. Save the account and verify repository access.

Security Considerations

The underlying principle remains relevant even though the product screens and authentication options have changed: interactive account passwords should not be embedded into development tooling when a scoped credential or key-based authentication mechanism is available.

For current environments, follow GitHub and SourceTree's current authentication documentation and prefer the narrowest permissions necessary for the task. Rotate or revoke credentials that are no longer required.

Takeaway

Two-factor authentication changes how external Git clients authenticate with GitHub. The exact SourceTree configuration has evolved since this article was written, but separating account authentication from tool-specific repository credentials remains an important security practice.