GitHub API Authentication Incident June 10 2026

On June 10, 2026, GitHub experienced a significant service degradation that caused sporadic authentication failures for approximately 15% of API traffic. The incident resulted in erroneous 401 responses, which triggered unnecessary authentication flows in third-party app integrations and disrupted various developer workflows.

Incident Timeline and Resolution

GitHub resolved the authentication issues affecting API requests and the "Issues" service by 16:39 UTC on June 10, 2026. The timeline of the event is as follows:

  • 15:20 UTC: GitHub began investigating reports of impacted performance across several services.
  • 15:23 UTC: API Requests were officially flagged as experiencing degraded availability.
  • 15:27 UTC: The "Issues" service was flagged as experiencing degraded performance.
  • 15:46 UTC: Degradation for the "Issues" service was mitigated, and investigation continued into the 15% of API traffic experiencing authentication failures.
  • 16:21 UTC: GitHub identified a problematic component in their infrastructure as the cause of the sporadic 401 responses.
  • 16:36 UTC: The degradation affecting API Requests was mitigated.
  • 16:39 UTC: The incident was declared resolved.

Impact on Developer Tools and Integrations

The sporadic nature of the 401 authentication errors led to widespread disruption across the GitHub ecosystem. Because the system returned an authentication failure rather than a server error, many tools automatically attempted to re-authenticate, creating a loop of failed logins.

Affected Services and Extensions

Users reported failures in the following areas:

  • IDE Extensions: The GitHub Pull Requests VS Code extension and other GitHub-integrated IDE tools experienced repeated login prompts.
  • CI/CD and Automation: CodeQL actions and Heroku authenticated connections were reported as failing due to authentication errors.
  • C&C Tools: The gh CLI tool was impacted, affecting remote git operations for users relying on the CLI for authentication.
  • Browser Extensions: The Refined GitHub Chrome extension experienced service disruptions.
  • Mobile: The GitHub iOS app logged users out unexpectedly.

Community Feedback and Technical Critique

Developers on Hacker News discussed the impact of the incident, with several highlighting the technical shortcomings of how the error was handled.

Error Code Mismanagement

One user noted that the use of 401 (Unauthorized) instead of 500 (Internal Server Error) was particularly disruptive:

I'd much prefer to get a 500 than a 401 if there is something broken in the server. This wasted a solid hour of my day.

Status Page Accuracy

There was criticism regarding how GitHub's status page categorizes incidents. Some users argued that because authentication is grouped under "API," the status page may not explicitly show the downtime for other services that rely on that authentication, such as the gh CLI, potentially leading to inflated uptime statistics.

Their status pages are not well defined, but they treat them as such, leading to inflated uptime numbers.

Sources