gh does not document a built-in way to select among multiple accounts on the same GitHub host based on repository owner. You can create that behavior with a custom wrapper: read the repository’s remote, map its owner to a token, and run gh with that token supplied as GH_TOKEN. This uses documented token precedence; the owner-to-token mapping is your own logic.
What GitHub CLI selects automatically—and what it does not
GitHub’s guide to using the CLI across platforms says that gh can detect the intended account from a local repository’s context. That does not mean it chooses the right account when several accounts are configured for the same host: the guide directs users to gh auth switch for that case. The documentation does not promise automatic account selection by repository owner. GitHub’s multiple-account guide
As an Amazon Associate I earn from qualifying purchases.
Keep three decisions separate:
- Host: Which GitHub instance the command targets.
ghcan infer it from repository context;GH_HOSTsets a default when it cannot. - Repository: Which repository a command targets.
GH_REPOcan specify one in[HOST/]OWNER/REPOform. - Credentials: Which token authenticates the request. An environment token takes precedence over credentials stored by
gh.
These settings are documented in the GitHub CLI environment variables reference. Setting a host or repository does not itself choose an account for each owner.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Choose between manual switching and an owner-based wrapper
| Approach | How it works | Best fit | Key limitation |
|---|---|---|---|
gh auth switch |
Changes the active account for a host. | Occasional manual changes between accounts. | You select the account; it is not an owner-to-token mapping. GitHub CLI gh auth switch manual |
Per-command GH_TOKEN |
Supplies a token in the environment for a command invocation. | Scripts or a custom launcher that selects credentials from the repository owner. | You must maintain and secure the mapping. GitHub CLI environment variables reference |
To switch manually, run gh auth switch. If more than one account makes the choice ambiguous, provide --user or select the account in the prompt. For one-time token inspection, gh auth token outputs the active account’s token by default and can target a named user; treat the output as a secret. GitHub CLI gh auth token manual
Build a wrapper that maps repository owners to tokens
The pattern below is a custom approach, not a built-in gh feature. Its important pieces are: identify the repository owner, look up the corresponding token from a secure source, and set GH_TOKEN only for the gh process. The example is pseudocode because token storage and remote parsing depend on your environment.
- Read the configured Git remote. Pick a deliberate remote, such as
origin, rather than assuming the first remote always identifies the repository you intend to use. - Parse the remote into host, owner, and repository. Handle both HTTPS forms such as
https://github.com/OWNER/REPO.gitand SSH forms such as[email protected]:OWNER/REPO.git. Remove an optional.gitsuffix. Do not treat an arbitrary path component as the owner. - Look up the owner’s token. Use a secret manager or another protected credential source. Avoid putting raw tokens in the wrapper, shell history, logs, or command-line arguments.
- Run
ghwith the selected token in its environment. For example, the invocation conceptually looks likeGH_TOKEN="$token" gh "$@". A process-scoped environment assignment avoids changing the stored active account. - Test the mapping against real operations. Confirm the selected owner, host, and repository before relying on the wrapper, and verify that the token has the permissions required for the particular operation.
For GitHub.com and ghe.com, GH_TOKEN takes precedence over GITHUB_TOKEN; environment tokens take precedence over credentials stored by gh. Enterprise Server has corresponding enterprise variables. The environment variable reference documents the relevant names and precedence. The gh auth login manual also says that gh uses an authentication token found in environment variables.
Handle remotes, forks, and worktrees deliberately
Owner-based selection is only as reliable as the repository identity your wrapper uses. Decide how these cases should behave before using it for routine work:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Multiple remotes: A fork commonly has both a fork remote and an upstream remote. Choose whether credentials follow the checked-out repository’s owner or the remote targeted by a particular operation; those may differ.
- Forks: A branch can be based on an upstream project while the configured
originbelongs to the fork owner. Make the mapping rule explicit rather than silently assuming one interpretation. - Worktrees: Worktrees share repository configuration in ways that can affect which remote is observed. Test the wrapper in each worktree arrangement you use.
- Unknown owner or host: Fail closed with a clear error instead of falling back to an unrelated account’s token.
- Commands outside a repository: Require an explicit repository or host-to-token choice, or decline to run. A wrapper cannot infer an owner if no suitable repository context is available.
For commands that target a repository other than the one represented by the chosen remote, ensure the token mapping matches the actual target. GH_REPO can name a target repository, but it does not make a wrapper’s remote-based owner lookup correct automatically.
Protect tokens and validate access
A token supplied through an environment variable is still a credential available to the invoked process. Keep its scope and lifetime appropriate to the work, prefer short-lived or narrowly scoped credentials where available, and verify the required permissions for each GitHub operation. The reviewed CLI documentation explains how environment credentials are selected; it does not prescribe one universal permission set for every command.
- Do not print tokens for debugging or leave them in shared terminal recordings.
- Keep secret values out of source control and command history.
- Check that a wrapper handles missing, expired, or unauthorized tokens without silently using a different account.
- Use
gh auth statusand a low-risk command to check the effective authentication context before an important operation; avoid displaying token values.
The CLI’s token inspection command can reveal credential material, so avoid sending its output to logs or shared sessions. GitHub CLI gh auth token manual
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
