What are github tokens?

[ledm]

So, I've gotten an email from github:

You recently used a password to access the repository at ESMValGroup/...

Basic authentication using a password to Git is deprecated and will soon no longer work. Visit https://github.blog/2020-12-15-token-authentication-requirements-for-git-operations/ for more information around suggested workarounds and removal dates.

What does this mean, what are tokens, and how do I set this up?

[ledm]

I asked this question in a private discussion and here are some of the answers:

Firstly, @zklaus answered: "What are tokens?":

They are like a password, but you can create as many as you need and will use each one only in one scenario. Additionally, you can limit what can be done with each one individually. These two features together make them more secure both in a situation where somebody else might see them and when you need to renew them.

In practice, github will automatically generate a long hash password for you, and you get to decide what permissions are associated with this password.

How do you create a token?

Please follow this official guide from github: https://docs.github.com/en/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token

So what do I do with it?

In most cases, you'll only want your token to change your repos (for pushing/pulling) so you can just tick the first box.
Once you've created a token, make a local copy of it, somewhere secure.

Do I have to keep enterring my token every time?

Nope, if you want git to remember your username and token, you can turn on the credential helper cache:
$ git config --global credential.helper cache
More details here: https://docs.github.com/en/github/getting-started-with-github/getting-started-with-git/caching-your-github-credentials-in-git

Thanks to @zklaus, @valeriupredoi, @bouweandela @bettina-gier for the help!

[rswamina]

Where does the 2-factor authentication fit in ? I set it up but get a Time based on-time password only when I sign into the Github webpage. The recovery codes/on-time password/passphrase do not seem to be connected to when I do a push or pull if I uses ssh keys.