GitHub CLI Cheatsheet

Auth and Config

Use this GitHub CLI reference while you build software engineering projects, review code, or refresh the syntax you reach for most.

Logging In

gh auth login is interactive by default. It walks through host, protocol, and browser or token.

gh auth login                          # interactive setup
gh auth login --web                    # browser OAuth flow
gh auth login --web --clipboard        # copy the device code automatically
gh auth login --with-token < token.txt # read a PAT from stdin
echo "$MY_PAT" | gh auth login --with-token
gh auth login --hostname github.example.com
gh auth login --git-protocol ssh --skip-ssh-key
gh auth login --scopes "read:org,project"

Flag	Meaning
`-w`, `--web`	Open a browser for the OAuth device flow
`--with-token`	Read the token from standard input, no prompts
`-h`, `--hostname`	Target a GitHub Enterprise Server or `ghe.com` host
`-p`, `--git-protocol`	`ssh` or `https` for git operations on this host
`-s`, `--scopes`	Extra OAuth scopes beyond the default set
`-c`, `--clipboard`	Copy the one-time device code to the clipboard
`--insecure-storage`	Store the token in plain text instead of the OS keyring
`--skip-ssh-key`	Do not offer to generate and upload an SSH key

--with-token never prompts, which is what makes it the form to use in a script or a CI step. It reads stdin, so pipe or redirect into it rather than passing the token as an argument where it would land in shell history.

Status, Accounts, Scopes

gh auth status                       # every host, account, and scope list
gh auth status --active              # only the active account per host
gh auth status --show-token          # print the token itself
gh auth status --json hosts --jq '.hosts | keys'
gh auth token                        # just the token for the active account
gh auth switch                       # pick another stored account
gh auth switch --hostname github.com --user monalisa
gh auth logout --hostname github.com --user monalisa

Multiple accounts can be stored per host. Only one is active at a time, and gh auth switch flips it.

When a command fails with a 403 or a "missing scope" hint, add the scope rather than logging in again:

gh auth refresh -s write:org
gh auth refresh --scopes read:project,workflow
gh auth refresh --remove-scopes delete_repo
gh auth refresh --reset-scopes        # back to the default minimum
gh auth refresh                       # top up to the current minimum set

workflow is the scope people forget. Without it, pushing a change under .github/workflows/ is rejected, and gh workflow run fails.

Git Credentials

gh auth setup-git
gh auth setup-git --hostname github.example.com

That registers gh as git's credential helper, so plain git push over HTTPS uses your gh token with no separate PAT in ~/.git-credentials. Skip it if you use SSH remotes.

gh config set git_protocol ssh --host github.com

With git_protocol set to ssh, gh repo clone and gh repo create --push produce git@github.com: remotes instead of HTTPS ones.

Config

gh config list                       # every key and current value
gh config get editor
gh config set editor "code --wait"
gh config set editor nvim
gh config set pager "less -FRX"
gh config set pager cat              # disable paging entirely
gh config set prompt disabled        # never prompt, fail instead
gh config set browser firefox
gh config set git_protocol ssh
gh config list --host github.example.com
gh config clear-cache

Key	Values
`git_protocol`	`https` (default) or `ssh`
`editor`	Any command, blank falls back to `$GH_EDITOR`/`$EDITOR`
`prompt`	`enabled` (default) or `disabled`
`prefer_editor_prompt`	`enabled` opens `$EDITOR` for body prompts
`pager`	Pager command, or `cat` to turn paging off
`browser`	Browser command for `--web` flags
`color_labels`	`enabled` renders labels in their real hex color
`spinner`	`disabled` for quieter CI logs
`accessible_colors`, `accessible_prompter`	4-bit colors, screen-reader prompts
`telemetry`	`enabled`, `disabled`, or `log`

Config lives in $GH_CONFIG_DIR, defaulting to ~/.config/gh/ ($XDG_CONFIG_HOME/gh when set). hosts.yml there holds accounts, config.yml holds these keys.

Environment Variables

Env wins over stored config, which is how CI authenticates without a login step.

Variable	Effect
`GH_TOKEN`, `GITHUB_TOKEN`	Token for `github.com` and `*.ghe.com`, beats stored creds
`GH_ENTERPRISE_TOKEN`, `GITHUB_ENTERPRISE_TOKEN`	Token for GitHub Enterprise Server hosts
`GH_HOST`	Default hostname when none can be inferred from the git remote
`GH_REPO`	`[HOST/]OWNER/REPO` to act on, instead of the local repo
`GH_EDITOR`, `GIT_EDITOR`, `VISUAL`, `EDITOR`	Editor, in that precedence order
`GH_BROWSER`, `BROWSER`	Browser for `--web`
`GH_PAGER`, `PAGER`	Pager for long output
`GH_DEBUG`	Truthy for verbose stderr, `api` to log HTTP traffic too
`GH_FORCE_TTY`	Force terminal output when piped, a number or a percentage sets width
`NO_COLOR`, `CLICOLOR_FORCE`	Strip or keep ANSI color
`GH_PROMPT_DISABLED`	Disable interactive prompting
`GH_NO_UPDATE_NOTIFIER`	Silence the once-a-day upgrade notice
`GH_CONFIG_DIR`	Alternate config directory

# Inside GitHub Actions, the built-in token is enough for most commands
env:
  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

GH_DEBUG=api gh pr list          # see the actual requests and responses
GH_REPO=cli/cli gh issue list    # act on another repo from anywhere
GH_HOST=github.example.com gh repo list

Enterprise Hosts

gh auth login --hostname github.example.com
gh auth status                          # lists each host separately
gh repo view github.example.com/team/app
GH_HOST=github.example.com gh pr list

The hostname is part of a repo's identity, so HOST/OWNER/REPO works anywhere OWNER/REPO does. For Enterprise Server, GH_ENTERPRISE_TOKEN is the env var that applies, not GH_TOKEN.