raw.githubusercontent.com - How to authenticate and how to see headers with information?

[jarofgreen]

Select Topic Area

Question

Body

https://github.blog/changelog/2025-05-08-updated-rate-limits-for-unauthenticated-requests/ It's now clear that unauthenticated access to raw.githubusercontent.com will be strongly rate limited and authenticated access is encouraged. Ok, message received loud and clear.

But the REST API documentation is clear on how to authenticate to the API and you even get handy HTTP headers back to tell you your status: eg

x-ratelimit-limit: 5000
x-ratelimit-remaining: 4998
x-ratelimit-reset: 1748427512
x-ratelimit-used: 2
x-ratelimit-resource: core

What I have not been able to find is any clear information on how to authenticate to raw.githubusercontent.com .

eg:

• Do personal access tokens in the Authorization header work? (I get a 200 but no indication that the auth details were used)
• Are we allowed to pass an app id and secret as basic auth? https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api?apiVersion=2022-11-28#primary-rate-limit-for-oauth-apps (This seems to 404 so I guess not?)

I did try experimenting, but another problem is that as far as I can see calls to raw.githubusercontent.com don't give you back any headers like the ones above so you can tell if you authentication attempt was successful or not.

Am I missing something obvious here? (Sorry if so)

Are there docs on this?

Can we get headers with auth feedback?

Thanks,

ps. If people want to discuss the wisdom of this rate limiting, there are existing issues - let's keep this issue focussed on docs and headers please! https://github.com/orgs/community/discussions/157887 and https://github.com/orgs/community/discussions/159123

[jarofgreen]

In the meantime, I guess one workaround is to switch to using this API method instead: https://docs.github.com/en/rest/repos/contents?apiVersion=2022-11-28#get-repository-content But that's a pain .....

[waterfire-source]

Hi, @jarofgreen
Just wanted to say - I’ve been running into the exact same confusion lately.

As far as I can tell, raw.githubusercontent.com doesn’t actually support authentication at all.
You can throw your personal access token in the header, but it’s ignored - no rate limit headers, no feedback, nothing.
So yeah, you get a 200, but that doesn’t mean your auth worked - it just means the file exists and was public anyway.

It looks like the only official way to do authenticated access is via the GitHub REST API (/repos/:owner/:repo/contents/:path), which gives you the proper rate limit headers and actually respects your token.
Not ideal if you’re just trying to grab a raw file, but at least it’s reliable.

Totally agree it would be nice if raw.githubusercontent.com gave you some signal back, even if it’s just a header saying “auth not supported.” Right now it’s just guesswork.

Hope that helps - and if you find anything better, I’m all ears too!

[jtarchie]

The raw subdomain has always been different from the API. It goes way back that people provided proxied alternatives -- ie rawgit, statically, etc.

Are you getting rate-limited?

[fritzmg]

@jtarchie all requests to github.com are rate limited now (see also https://github.com/orgs/community/discussions/157887). And there is no (known) way around the rate limit - except for the API, where you can use authenticated requests.

[jtarchie]

They may have decreased it, but the rate limit has been around for years:

• https://stackoverflow.com/questions/66522261/does-github-rate-limit-access-to-public-raw-files (2y ago)
• https://stackoverflow.com/questions/76645249/github-rate-limits-for-raw-githubusercontent-com-for-private-repos-orgs (1y)
• Running into raw.githubusercontent.com request limit python-poetry/poetry#976 (6y)

The first StackOverflow quotes this:

I spoke with our engineering team and learnt that there's a limit of 5000 requests per hour per IP address. Additionally, due to internal routing and caching, that 5000 figure isn't going to be exact. We may accept more but it's sometimes possible that we'll accept less too.

As was pointed out to me, if you're at risk of hitting this limit, then you're probably doing something wrong and there's a better way to obtain or even store the file.

Raw is intended to be useful for site users. People have automated its usage and abused it. GitHub has an API for contents, which has very well-defined documentation about the rate limits.

[fritzmg]

Yes, it was always there - but now it is 1 per minute instead of ~83 per minute.

[bypit-dev]

``loadstring(game:HttpGet("https://raw.githubusercontent.com/NinjaGamingx/Scripts/refs/heads/main/GrowAGarden"))()

[jarofgreen]

I don't understand - that appears to be a roblox command, but there is no authentication there? And so would also be rate limited?

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬