gh-auth-isolation

Detect and switch GitHub CLI identities for multi-account push and PR operations.

Updated Jun 2, 2026
One-click install
npx skills add https://github.com/codebytes/btt --skill gh-auth-isolation-codebytes
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: gh-auth-isolation
Source: https://github.com/codebytes/btt/tree/main/.squad/templates/skills/gh-auth-isolation
Command: npx skills add https://github.com/codebytes/btt --skill gh-auth-isolation-codebytes

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? AI agents and developers working with both an Enterprise Managed User (EMU) GitHub account and a personal account often hit permission errors when pushing to personal repos or creating PRs on forks, because the shell's default gh authentication is the wrong identity. ## Core Features & Use Cases - Identity Detection: Check the active GitHub account and token scopes with gh auth status before any operation. - Per-Operation Token Extraction: Pull a specific account's token with gh auth token --user and use it inline for pushes or PR creation without switching the global default. - Config Directory Isolation: Use GH_CONFIG_DIR to maintain fully separate gh configurations for EMU and personal accounts, with shell aliases for quick switching. - Use Case: An agent whose shell defaults to an EMU account needs to push a blog post to a personal GitHub Pages repo; it extracts the personal token, pushes via token-authenticated HTTPS, then cleans the remote URL so no token persists. ## Quick Start Ask the agent to check which GitHub account is active and push the current branch to your personal repository using the correct identity.

Frequently Asked Questions about gh-auth-isolation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I push to a personal GitHub repo when gh is logged into a work account?

Extract the personal account token with gh auth token --user personaluser, then push using token-authenticated HTTPS: git push https://personaluser:[email protected]/personaluser/repo.git branch. Afterwards reset the remote URL so the token is not persisted.

How do I check which GitHub account gh CLI is using?

Run gh auth status. It shows the logged-in username for each host, the active account, and the token scopes available, so you can verify the identity before any push or PR operation.

Can I use two GitHub accounts with gh CLI at the same time?

Yes. Use GH_CONFIG_DIR to point gh at a separate config directory for the second account, log in once there, and switch contexts per command via environment variables or shell aliases without changing the global default.

Why does git push fail with permission denied on my personal repo?

The failure happens because the default gh authentication is an EMU or work account that has no access to the personal repository. Verify with gh auth status, then authenticate the push with the personal account's token.

Is it safe to store GitHub tokens in environment variables or .env files?

No. Hardcoding tokens in scripts, .env files, or committed config risks exposure through history and process lists. Extract tokens at runtime with gh auth token --user and clean up remote URLs after inline use.