Github OAuth through Fork doesn't work if Enterprise Account doesn't allow, and dialog incorrectly reports green status

[craigvenz]

This morning I had to regenerate my Github PAT, and then Fork stopped authenticating. (I think I had been through this before when I first started with the Enterprise organization, and this explains why I needed a PAT.)

I was trying to use the gh auth setup-git command from the command prompt (AI suggested, lol) which doesn't work in Fork.

Then tried to use the GH OAuth token in Fork itself, again, conveniently forgetting I had already tried this 3 months ago.

This is what the dialog looks like in Fork:

But when I try to fetch latest from an enterprise private repo where I need SSO to log in I get this (with verbose output on). Note that I am trying to use the global git instance, not Fork's private instance, here, because, lol, AI also suggested, "hey try the global git instead, it's probably Fork's private instance". Nope.

08:33:27.763332 exec-cmd.c:266          trace: resolved executable dir: C:/Program Files/Git/mingw64/bin
08:33:27.770334 git.c:502               trace: built-in: git fetch --prune --all --progress
08:33:27.771332 read-cache.c:2366       performance: 0.000146500 s:  read cache .git/index
08:33:27.773328 run-command.c:674       trace: run_command: GIT_DIR=.git git remote-https origin https://github.com/<redacted>/<redacted>.git
08:33:27.773328 run-command.c:946       trace: start_command: git remote-https origin https://github.com/<redacted>/<redacted>.git
08:33:27.784334 exec-cmd.c:266          trace: resolved executable dir: C:/Program Files/Git/mingw64/libexec/git-core
08:33:27.787335 git.c:812               trace: exec: git-remote-https origin https://github.com/<redacted>/<redacted>.git
08:33:27.787335 run-command.c:674       trace: run_command: git-remote-https origin https://github.com/<redacted>/<redacted>.git
08:33:27.787335 run-command.c:946       trace: start_command: git-remote-https origin https://github.com/<redacted>/<redacted>.git
08:33:27.799445 exec-cmd.c:266          trace: resolved executable dir: C:/Program Files/Git/mingw64/libexec/git-core
08:33:27.809009 http.c:1033             == Info: Could not find host github.com in the .netrc file; using defaults
08:33:27.844692 http.c:1033             == Info: Host github.com:443 was resolved.
08:33:27.844692 http.c:1033             == Info: IPv6: (none)
08:33:27.844692 http.c:1033             == Info: IPv4: 140.82.116.4
08:33:27.844692 http.c:1033             == Info:   Trying 140.82.116.4:443...
08:33:27.883004 http.c:1033             == Info: schannel: disabled automatic use of client certificate
08:33:27.885005 http.c:1033             == Info: ALPN: curl offers http/1.1
08:33:27.935534 http.c:1033             == Info: ALPN: server accepted http/1.1
08:33:27.935534 http.c:1033             == Info: Established connection to github.com (140.82.116.4 port 443) from 192.168.86.27 port 53353 
08:33:27.935534 http.c:1033             == Info: using HTTP/1.x
08:33:27.935534 http.c:980              => Send header, 0000000241 bytes (0x000000f1)
08:33:27.935534 http.c:992              => Send header: GET /<redacted>/<redacted>.git/info/refs?service=git-upload-pack HTTP/1.1
08:33:27.935534 http.c:992              => Send header: Host: github.com
08:33:27.935534 http.c:992              => Send header: User-Agent: git/2.55.0.windows.3
08:33:27.935534 http.c:992              => Send header: Accept: */*
08:33:27.935534 http.c:992              => Send header: Accept-Encoding: deflate, gzip, br, zstd
08:33:27.935534 http.c:992              => Send header: Pragma: no-cache
08:33:27.935534 http.c:992              => Send header: Git-Protocol: version=2
08:33:27.935534 http.c:992              => Send header:
08:33:27.935534 http.c:1033             == Info: Request completely sent off
08:33:27.978047 http.c:1033             == Info: schannel: remote party requests renegotiation
08:33:27.978047 http.c:1033             == Info: schannel: renegotiating SSL/TLS connection
08:33:27.978047 http.c:1033             == Info: schannel: SSL/TLS connection renegotiated
08:33:27.978047 http.c:1033             == Info: schannel: remote party requests renegotiation
08:33:27.978047 http.c:1033             == Info: schannel: renegotiating SSL/TLS connection
08:33:27.978047 http.c:1033             == Info: schannel: SSL/TLS connection renegotiated
08:33:28.055451 http.c:980              <= Recv header, 0000000027 bytes (0x0000001b)
08:33:28.055451 http.c:992              <= Recv header: HTTP/1.1 401 Unauthorized
08:33:28.055451 http.c:980              <= Recv header, 0000000026 bytes (0x0000001a)
08:33:28.055451 http.c:992              <= Recv header: Server: GitHub-Babel/3.0
08:33:28.055451 http.c:980              <= Recv header, 0000000054 bytes (0x00000036)
08:33:28.055451 http.c:992              <= Recv header: Content-Security-Policy: default-src 'none'; sandbox
08:33:28.055451 http.c:980              <= Recv header, 0000000041 bytes (0x00000029)
08:33:28.055451 http.c:992              <= Recv header: Content-Type: text/plain; charset=UTF-8
08:33:28.055451 http.c:980              <= Recv header, 0000000088 bytes (0x00000058)
08:33:28.055451 http.c:992              <= Recv header: www-authenticate: Basic realm="GitHub" enterprise_hint="<redacted>" domain_hint="<redacted>"
08:33:28.055451 http.c:980              <= Recv header, 0000000020 bytes (0x00000014)
08:33:28.055451 http.c:992              <= Recv header: Content-Length: 21
08:33:28.055451 http.c:980              <= Recv header, 0000000037 bytes (0x00000025)
08:33:28.055451 http.c:992              <= Recv header: Date: Fri, 31 Jul 2026 15:33:28 GMT
08:33:28.055451 http.c:980              <= Recv header, 0000000023 bytes (0x00000017)
08:33:28.055451 http.c:992              <= Recv header: X-Frame-Options: DENY
08:33:28.055451 http.c:980              <= Recv header, 0000000073 bytes (0x00000049)
08:33:28.055451 http.c:992              <= Recv header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
08:33:28.055451 http.c:980              <= Recv header, 0000000057 bytes (0x00000039)
08:33:28.055451 http.c:992              <= Recv header: X-GitHub-Request-Id: D069:287394:2DBAA5:2ECADD:6A6CC048
08:33:28.055451 http.c:980              <= Recv header, 0000000027 bytes (0x0000001b)
08:33:28.055451 http.c:992              <= Recv header: x-github-edge-region: sea
08:33:28.055451 http.c:980              <= Recv header, 0000000002 bytes (0x00000002)
08:33:28.055451 http.c:992              <= Recv header:
08:33:28.055451 http.c:1006             <= Recv data, 0000000021 bytes (0x00000015)
08:33:28.055451 http.c:1021             <= Recv data: Repository not found.
08:33:28.055451 http.c:1033             == Info: Connection #0 to host github.com:443 left intact
08:33:28.055451 run-command.c:674       trace: run_command: 'C:/Users/Craig.Venz/AppData/Local/Fork/current/Fork.AskPass.exe get'
08:33:28.055451 run-command.c:946       trace: start_command: 'C:/Program Files/Git/usr/bin/sh.exe' -c 'C:/Users/Craig.Venz/AppData/Local/Fork/current/Fork.AskPass.exe get' 'C:/Users/Craig.Venz/AppData/Local/Fork/current/Fork.AskPass.exe get'
08:33:28.130307 http.c:1033             == Info: Reusing existing https: connection with host github.com
08:33:28.130307 http.c:1033             == Info: Server auth using Basic with user 'Craig-Venz_<redacted>'
08:33:28.130307 http.c:980              => Send header, 0000000344 bytes (0x00000158)
08:33:28.130307 http.c:992              => Send header: GET /<redacted>/<redacted>.git/info/refs?service=git-upload-pack HTTP/1.1
08:33:28.130307 http.c:992              => Send header: Host: github.com
08:33:28.130307 http.c:992              => Send header: Authorization: Basic <redacted>
08:33:28.130307 http.c:992              => Send header: User-Agent: git/2.55.0.windows.3
08:33:28.130307 http.c:992              => Send header: Accept: */*
08:33:28.130307 http.c:992              => Send header: Accept-Encoding: deflate, gzip, br, zstd
08:33:28.130307 http.c:992              => Send header: Pragma: no-cache
08:33:28.130307 http.c:992              => Send header: Git-Protocol: version=2
08:33:28.130307 http.c:992              => Send header:
08:33:28.130307 http.c:1033             == Info: Request completely sent off
08:33:28.307344 http.c:980              <= Recv header, 0000000027 bytes (0x0000001b)
08:33:28.307344 http.c:992              <= Recv header: HTTP/1.1 401 Unauthorized
08:33:28.307344 http.c:980              <= Recv header, 0000000026 bytes (0x0000001a)
08:33:28.307344 http.c:992              <= Recv header: Server: GitHub-Babel/3.0
08:33:28.307344 http.c:980              <= Recv header, 0000000054 bytes (0x00000036)
08:33:28.307344 http.c:992              <= Recv header: Content-Security-Policy: default-src 'none'; sandbox
08:33:28.307344 http.c:980              <= Recv header, 0000000041 bytes (0x00000029)
08:33:28.307344 http.c:992              <= Recv header: Content-Type: text/plain; charset=UTF-8
08:33:28.307344 http.c:1033             == Info: Basic authentication problem, ignoring.
08:33:28.307344 http.c:980              <= Recv header, 0000000088 bytes (0x00000058)
08:33:28.307344 http.c:992              <= Recv header: www-authenticate: Basic realm="GitHub" enterprise_hint="<redacted>" domain_hint="<redacted>"
08:33:28.307344 http.c:980              <= Recv header, 0000000020 bytes (0x00000014)
08:33:28.307344 http.c:992              <= Recv header: Content-Length: 21
08:33:28.307344 http.c:980              <= Recv header, 0000000037 bytes (0x00000025)
08:33:28.307344 http.c:992              <= Recv header: Date: Fri, 31 Jul 2026 15:33:28 GMT
08:33:28.307344 http.c:980              <= Recv header, 0000000023 bytes (0x00000017)
08:33:28.307344 http.c:992              <= Recv header: X-Frame-Options: DENY
08:33:28.307344 http.c:980              <= Recv header, 0000000073 bytes (0x00000049)
08:33:28.307344 http.c:992              <= Recv header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
08:33:28.307344 http.c:980              <= Recv header, 0000000057 bytes (0x00000039)
08:33:28.307344 http.c:992              <= Recv header: X-GitHub-Request-Id: D069:287394:2DBB65:2ECB9B:6A6CC048
08:33:28.307344 http.c:980              <= Recv header, 0000000027 bytes (0x0000001b)
08:33:28.307344 http.c:992              <= Recv header: x-github-edge-region: sea
08:33:28.307344 http.c:980              <= Recv header, 0000000002 bytes (0x00000002)
08:33:28.307344 http.c:992              <= Recv header:
08:33:28.307344 http.c:1006             <= Recv data, 0000000021 bytes (0x00000015)
08:33:28.307344 http.c:1021             <= Recv data: Repository not found.
08:33:28.307344 http.c:1033             == Info: Connection #0 to host github.com:443 left intact
08:33:28.307344 run-command.c:674       trace: run_command: 'C:/Users/Craig.Venz/AppData/Local/Fork/current/Fork.AskPass.exe erase'
08:33:28.307344 run-command.c:946       trace: start_command: 'C:/Program Files/Git/usr/bin/sh.exe' -c 'C:/Users/Craig.Venz/AppData/Local/Fork/current/Fork.AskPass.exe erase' 'C:/Users/Craig.Venz/AppData/Local/Fork/current/Fork.AskPass.exe erase'
08:33:28.377347 run-command.c:674       trace: run_command: 'git credential-manager erase'
08:33:28.377347 run-command.c:946       trace: start_command: 'C:/Program Files/Git/usr/bin/sh.exe' -c 'git credential-manager erase' 'git credential-manager erase'
08:33:28.430549 exec-cmd.c:266          trace: resolved executable dir: C:/Program Files/Git/mingw64/libexec/git-core
08:33:28.433886 git.c:812               trace: exec: git-credential-manager erase
08:33:28.433886 run-command.c:674       trace: run_command: git-credential-manager erase
08:33:28.433886 run-command.c:946       trace: start_command: git-credential-manager erase
08:33:28.497251 exec-cmd.c:266          trace: resolved executable dir: C:/Program Files/Git/mingw64/libexec/git-core
08:33:28.499256 git.c:502               trace: built-in: git version
08:33:28.499256 trace.c:416             performance: 0.000078600 s: git command: 'C:/Program Files/Git/mingw64/libexec/git-core\git.exe' version
08:33:28.518685 exec-cmd.c:266          trace: resolved executable dir: C:/Program Files/Git/mingw64/libexec/git-core
08:33:28.521685 git.c:502               trace: built-in: git config list --show-scope -z --no-type
08:33:28.522685 trace.c:416             performance: 0.001531800 s: git command: 'C:/Program Files/Git/mingw64/libexec/git-core\git.exe' config list --show-scope -z --no-type
08:33:28.620876 trace.c:416             performance: 0.187687900 s: git command: 'C:\Program Files\Git\mingw64\libexec\git-core\git.exe' credential-manager erase
remote: Repository not found.
fatal: Authentication failed for 'https://github.com/<redacted>/<redacted>.git/'
08:33:28.627397 trace.c:416             performance: 0.840097400 s: git command: git remote-https origin https://github.com/<redacted>/<redacted>.git
08:33:28.628397 trace.c:416             performance: 0.859516700 s: git command: git.exe -c credential.helper= -c credential.helper=C:/Users/Craig.Venz/AppData/Local/Fork/current/Fork.AskPass.exe -c credential.helper=manager fetch --prune --all --progress

My ~/,gitconfig looks like this, which Fork ignores, it seems:

[user]
	name = Craig Venz
	email = craig.venz@<redacted>
[core]
	hooksPath = C:/Users/Craig.Venz/.git-hooks
[url "https://github.com/"]
	insteadOf = git@github.com:
[rescuetime]
	apikey = <redacted>
[credential "https://github.com"]
	helper = 
	helper = !'C:\\Program Files\\GitHub CLI\\gh.exe' auth git-credential
[credential "https://gist.github.com"]
	helper = 
	helper = !'C:\\Program Files\\GitHub CLI\\gh.exe' auth git-credential

These are the blocks of text of interest with me consulting with Claude Opus 5 about why this isn't working (I know...)

So the OAuth token is valid. It just can't see <redacted> repos. enterprise_hint="<redacted>" and the _<redacted> account suffix say this is an Enterprise Managed User setup, and EMU enterprises restrict third-party OAuth applications by default. Fork's OAuth app isn't on the approved list; gh's is, which is exactly why the CLI works and Fork doesn't.

The account status indicator reports green on a token that can't actually reach the org's repos.
Fork forces -c credential.helper= and rebuilds the chain, which discards every helper configured in gitconfig. That's what makes gh auth setup-git a no-op under Fork and forces you to maintain the token in two places. A "use the system credential helper chain" option would remove the whole class of problem.