How to Install GitHub CLI on Debian 13, 12 and 11

Pull requests, issues, releases, workflow checks, and repository tasks are easier to automate when Debian has GitHub’s official gh command available beside Git. To install GitHub CLI on Debian with current upstream updates, use GitHub CLI from GitHub’s official APT repository instead of relying only on Debian’s default package set.

Debian package availability differs by release. Debian 13 (Trixie) and Debian 12 (Bookworm) provide older community gh packages, while Debian 11 (Bullseye) does not expose a default gh candidate in standard sources. GitHub’s maintainers also recommend the official repository because some community-distributed 2.45.x and 2.46.x builds are affected by deprecated GitHub API behavior. GitHub’s official repository provides the current upstream package across all three Debian releases, and normal Git operations still depend on the separate Git package for Debian.

Install GitHub CLI on Debian

GitHub’s official Linux instructions publish a codename-neutral stable APT suite for Debian, Raspberry Pi OS, and Ubuntu. On Debian, use a DEB822 source file so the repository, architecture, and signing key path stay easy to audit.

Install source	Debian 13	Debian 12	Debian 11	Best fit
Debian repositories	2.46.x series	2.23.x series	No default candidate in standard sources	Use only when your release provides a package and you accept Debian’s community-maintained version.
GitHub official APT repository	Current upstream release	Current upstream release	Current upstream release	Use for the current upstream release, GitHub-maintained packaging, and normal APT-managed updates.

Refresh Debian Package Metadata

Refresh Debian’s package metadata before adding the GitHub CLI repository so APT starts from current indexes. Review full system upgrades separately because apt upgrade can update packages unrelated to GitHub CLI.

sudo apt update

The setup commands use sudo for package and repository changes. If your account cannot run administrative commands yet, follow the guide to add a user to sudoers on Debian first.

Install Curl, GPG, and HTTPS Certificates

Install the small prerequisite set used for the repository setup. curl downloads the keyring, gpg lets you inspect the published fingerprints, and ca-certificates handles HTTPS certificate validation. If you want a deeper option reference, the curl command guide explains the download flags used for the keyring fetch.

sudo apt install curl ca-certificates gpg

Add the GitHub CLI Keyring

GitHub publishes a binary keyring file for the CLI repository, so download it directly and install the same file into APT’s keyring directory. The download runs as your user first, then sudo install copies the verified file into the root-owned path.

curl -fsSLo githubcli-archive-keyring.gpg https://cli.github.com/packages/githubcli-archive-keyring.gpg

Inspect the keyring fingerprints before installing it. GitHub’s current Linux package documentation lists these fingerprints for the official repository keys.

gpg --quiet --show-keys --with-fingerprint githubcli-archive-keyring.gpg

Confirm the output includes both fingerprint lines:

2C61 0620 1985 B60E 6C7A  C873 23F3 D4EA 7571 6059
7F38 BBB5 9D06 4DBC B3D8  4D72 5612 B364 6231 3325

GitHub’s April 2026 keyring update added the replacement signing key, so refreshed installs should show both fingerprints.

Create the keyring directory if it is missing, install the keyring with read permissions for APT, and remove the temporary copy from your current directory.

sudo install -m 0755 -d /etc/apt/keyrings
sudo install -m 0644 githubcli-archive-keyring.gpg /etc/apt/keyrings/githubcli-archive-keyring.gpg
rm -f githubcli-archive-keyring.gpg

Add the Official GitHub CLI Repository

Create a DEB822 source file for the official GitHub CLI repository. Current repository metadata publishes i386, amd64, armhf, and arm64 package indexes; the $(dpkg --print-architecture) command inserts your Debian architecture, and sudo tee writes the file with root privileges.

printf '%s\n' \
'Types: deb' \
'URIs: https://cli.github.com/packages' \
'Suites: stable' \
'Components: main' \
"Architectures: $(dpkg --print-architecture)" \
'Signed-By: /etc/apt/keyrings/githubcli-archive-keyring.gpg' \
| sudo tee /etc/apt/sources.list.d/github-cli.sources > /dev/null

Refresh APT so Debian reads the new source.

sudo apt update

Relevant output includes the GitHub CLI repository:

Get:1 https://cli.github.com/packages stable InRelease [3,917 B]
Get:2 https://cli.github.com/packages stable/main amd64 Packages [356 B]

Check that the official repository is now the candidate source for gh. Debian 13 and 12 may still show an older Debian package underneath the GitHub candidate, while Debian 11 may only show the GitHub source.

apt-cache policy gh

The version number changes as GitHub publishes new releases. In the version table, the candidate should include the GitHub CLI repository line:

        500 https://cli.github.com/packages stable/main amd64 Packages

Install the GitHub CLI Package

Install the gh package from the newly added repository. APT may also install git if your Debian system does not already have it, because GitHub CLI delegates clone, push, pull, and branch work to Git.

sudo apt install gh

Verify the installed GitHub CLI version.

gh --version

Example output from a current official repository install shows the installed version and its matching release tag.

gh version 2.92.0 (2026-04-28)
https://github.com/cli/cli/releases/tag/v2.92.0

Authenticate GitHub CLI on Debian

GitHub CLI needs an authenticated account before it can create pull requests, read private repositories, manage issues under your identity, or use organization resources that require authorization. Start the interactive login flow from your terminal.

gh auth login

The login prompts ask for these choices:

• Account type: Choose GitHub.com for normal public GitHub accounts.
• Git protocol: Choose HTTPS for the simplest setup, or SSH if your SSH keys are already configured for GitHub.
• Authentication method: Choose Login with a web browser for the browser-based device-code flow.

Check the active login after the browser flow completes.

gh auth status

Set Up Git Credential Integration

If you selected HTTPS during login, configure Git to use GitHub CLI as the credential helper for authenticated GitHub hosts. This lets normal Git commands reuse the same account instead of prompting separately.

gh auth setup-git

Organizations that enforce SAML single sign-on may still require browser authorization for the token after login. That approval happens in GitHub, not in Debian’s package manager.

Authenticate to GitHub Enterprise Server

Use the --hostname flag when your organization runs GitHub Enterprise Server instead of the public github.com service. Replace the example hostname with your enterprise instance.

gh auth login --hostname git.example.com

Switch Between GitHub CLI Accounts

GitHub CLI can store more than one account for a host. Authenticate the extra account first, then switch the active account when you move between work and personal repositories.

gh auth login
gh auth switch

Set the GitHub CLI Text Editor

GitHub CLI opens your configured editor for longer pull request descriptions, release notes, and issue text. Set an editor explicitly if the default does not match your workflow.

gh config set editor "nano"

For Visual Studio Code, use the wait flag so gh pauses until you close the editor window.

gh config set editor "code --wait"

Use Common GitHub CLI Commands

The gh command handles GitHub platform actions, while git still handles commits, pulls, pushes, branches, local history, and remotes. If your Git identity is not configured yet, set it with the Git username and email guide before creating commits.

Clone a GitHub Repository

Clone a repository by owner and repository name without copying the full web URL.

gh repo clone owner/repo

List GitHub Issues

List open issues for the repository in your current directory.

gh issue list

Create a Pull Request

Create a pull request from the current branch and follow the interactive prompts for title, body, reviewers, and base branch.

gh pr create

Check Out a Pull Request

Check out a pull request locally when you need to test or review someone else’s branch.

gh pr checkout 123

List GitHub Actions Workflows

Show the workflows configured in the current repository before running or inspecting workflow history.

gh workflow list

List GitHub Releases

List releases for the repository in your current directory when you need to check tags or published release assets from the terminal.

gh release list

Manage GitHub CLI Extensions

Extensions add subcommands to gh, but they are separate from the base GitHub CLI package. Search extensions from the terminal, then review what is already installed.

gh extension search
gh extension list

Troubleshoot GitHub CLI on Debian

Fix Unable to Locate Package gh

If APT cannot find gh, the official repository was not refreshed, the source file was not written correctly, or the keyring path does not match the Signed-By field.

E: Unable to locate package gh

Refresh APT and check the candidate again.

sudo apt update
apt-cache policy gh

If the official repository still does not appear, re-check the source file and keyring path from the repository setup.

cat /etc/apt/sources.list.d/github-cli.sources
ls -l /etc/apt/keyrings/githubcli-archive-keyring.gpg

Fix GitHub CLI Repository Signature Errors

If sudo apt update reports a missing public key or a Signed-By conflict, check for duplicate source entries first. A missing public key usually needs a refreshed keyring, while a Signed-By conflict often means an older one-line GitHub CLI source still points at the same repository with a different trust path.

The following signatures couldn't be verified because the public key is not available

Search APT source files for duplicate GitHub CLI repository entries.

grep -R "cli.github.com/packages" /etc/apt/sources.list /etc/apt/sources.list.d 2>/dev/null

If the output shows both /etc/apt/sources.list.d/github-cli.sources and an older github-cli.list entry, remove the older one-line file after confirming it points at GitHub CLI.

sudo rm -f /etc/apt/sources.list.d/github-cli.list

Refresh the keyring file next, then rerun the APT update.

curl -fsSLo githubcli-archive-keyring.gpg https://cli.github.com/packages/githubcli-archive-keyring.gpg
sudo install -m 0755 -d /etc/apt/keyrings
sudo install -m 0644 githubcli-archive-keyring.gpg /etc/apt/keyrings/githubcli-archive-keyring.gpg
rm -f githubcli-archive-keyring.gpg
sudo apt update

Refresh Expired GitHub CLI Authentication

Expired, revoked, or scope-limited tokens can make otherwise valid gh commands fail. Check your login state, then refresh the token scopes.

gh auth status
gh auth refresh

Fix SSH Public Key Errors

If clone or push operations fail with a public-key error, GitHub CLI may be set to SSH while your account only has HTTPS credentials configured.

git@github.com: Permission denied (publickey).

Switch GitHub CLI’s Git protocol to HTTPS, or set it back to SSH after you add a valid SSH key to your GitHub account.

gh config set git_protocol https

gh config set git_protocol ssh

Clear GitHub CLI Token Environment Overrides

If GH_TOKEN or GITHUB_TOKEN is set in your shell, GitHub CLI uses that environment token instead of storing browser-login credentials. Clear the token variables before running the login flow again.

unset GH_TOKEN
unset GITHUB_TOKEN
gh auth login

Update GitHub CLI on Debian

APT handles future GitHub CLI updates after the official repository is installed. Use --only-upgrade when you want to upgrade gh without installing it on systems where it is absent.

sudo apt update
sudo apt install --only-upgrade gh

Remove GitHub CLI from Debian

If you authenticated GitHub CLI and want to remove local account entries, log out before removing the package. This removes local authentication configuration for the selected host and account, but it does not revoke OAuth tokens in GitHub’s web settings.

gh auth status
gh auth logout --hostname github.com --user your-username

Remove the gh package first. This keeps package removal separate from optional repository cleanup.

sudo apt remove gh

If you also want to stop receiving packages from GitHub’s repository, remove the source file, any older one-line source created by previous GitHub CLI instructions, and the keyring, then refresh APT.

sudo rm -f /etc/apt/sources.list.d/github-cli.sources
sudo rm -f /etc/apt/sources.list.d/github-cli.list
sudo rm -f /etc/apt/keyrings/githubcli-archive-keyring.gpg
sudo apt update

Confirm the package is no longer installed.

dpkg-query -W -f='${db:Status-Abbrev}\n' gh 2>/dev/null | grep '^ii' || echo "gh is not installed"

Expected output after removal:

gh is not installed

If APT installed Git only as a dependency for GitHub CLI, review the autoremove preview before deleting anything else. Reused Debian systems often have unrelated autoremovable packages, so do not confirm removal until the list makes sense.

sudo apt autoremove --dry-run

Removing the configuration directory permanently deletes GitHub CLI settings for the current user, including stored hosts, account selections, aliases, and extension metadata. Export or note anything you need before removing the directory.

Check whether a local GitHub CLI configuration directory exists before deleting user data.

ls -ld ~/.config/gh 2>/dev/null || echo "No GitHub CLI config directory found"

rm -rf -- ~/.config/gh

Conclusion

GitHub CLI is available on Debian as gh from GitHub’s official APT repository, with authentication, updates, and cleanup handled from the terminal. Use it alongside Git for issues, pull requests, releases, and workflow commands; for graphical repository management, install GitHub Desktop on Debian.