Two GitHub accounts on one machine. Every commit Verified.

#What you end up with

• Both accounts logged in with the GitHub CLI (gh). You switch with one command and never paste tokens.
• One GPG key that holds both of your emails, so commits are signed for either account.
• Verified next to every commit you push, on both accounts.
• The right email picked automatically: work repos use your work email, everything else uses your personal one.

#Before you start

Tip: use two browser profiles (one per account). Logging in each account becomes painless, because GitHub approves a login for whichever account is signed in in the browser.

#Quick setup

#1. Log in to both accounts

gh keeps several accounts side by side. Run the login once per account, with the browser signed in as that account.

gh auth login        # personal (browser signed in as personal)
gh auth login        # work     (browser signed in as work)
gh auth setup-git    # lets git push/pull through gh, no passwords
gh auth status       # should list both accounts

Answers to pick: GitHub.com → HTTPS → Yes → Login with a web browser. Then paste the code shown in the terminal on the page that opens. Full walkthrough: Log in to two GitHub accounts

#2. Make one GPG key with both emails

The key is your digital signature. One key can carry several emails, so add both.

gpg --full-generate-key                                 # personal email, leave Comment EMPTY
gpg --list-secret-keys --keyid-format=long              # copy the long key ID (40 characters)
gpg --quick-add-uid <KEY_ID> "Your Name <you@company.com>"
gpg --check-trustdb                                     # marks the new email as yours

Expiry: choose 0 (never) or 2y. Don't type a huge value like 100y, gpg rejects it. Full walkthrough: Create one GPG key with both emails

#3. Put the key on both accounts

GitHub needs the public half of the key to check your signatures.

gpg --armor --export <KEY_ID> > key.asc

On each account, open github.com/settings/gpg/new and paste the whole file. Full walkthrough, and the terminal way with gh: Add the GPG key to GitHub

#4. Tell Git who you are and to sign everything

git config --global user.name  "Your Name"
git config --global user.email "you@personal.dev"
git config --global user.signingkey <KEY_ID>
git config --global commit.gpgsign true
git config --global tag.gpgsign true

Also add export GPG_TTY=$(tty) to ~/.bashrc / ~/.zshrc (fish: set -gx GPG_TTY (tty)) so gpg can ask for your passphrase. Full walkthrough: Make Git sign every commit

#5. Work email in work folders (optional, recommended)

Put work repos in ~/work/ and Git uses your work email there by itself.

mkdir -p ~/work
printf '[user]\n    email = you@company.com\n' > ~/.gitconfig-work
git config --global includeIf."gitdir:~/work/".path ~/.gitconfig-work

Full walkthrough: Work email by folder

#6. Back up your key now

If your laptop dies and you have no backup, the key is gone for good. It takes 1 minute:

gpg --armor --export-secret-keys <KEY_ID> > private-key-BACKUP.asc

Copy it to a USB stick or password manager, never to a repo or cloud chat. Full guide (restore, renew, lost key): Back up your GPG key

#Every day

gh auth switch          # choose the account that owns the repo you'll push to
git commit -m "..."     # signed automatically, email picked by folder
git push

Then check the commit on GitHub: it should show Verified. More: Switch accounts and check Verified commits

#Recommended settings and tips

These aren't required, but they save most developers trouble later.

#Check what your device already set

Some systems, distros or tools put their own Git defaults in /etc/gitconfig or ~/.gitconfig. See everything that's active and which file it comes from:

git config --list --show-origin
git config --show-origin pull.rebase     # check one setting

A value set by the system can be overridden with --global.

#Settings most developers want

#Privacy

• Hide your real email. Each account has a noreply address (e.g. 12345+you@users.noreply.github.com) on settings/emails. You can use it as the commit email and add it to your GPG key too. Your real email then never appears in public history.
• On the same page, turn on Keep my email addresses private and Block command line pushes that expose my email.

#Security

• Turn on 2FA for both accounts: github.com/settings/security.

• Use a passphrase on the GPG key and keep it in a password manager.

• Never commit key files. Add this to your global gitignore:

  printf '*.asc\n*.gpg\n*.rev\n' >> ~/.gitignore_global
  git config --global core.excludesFile ~/.gitignore_global

  Copy

• Don't store tokens in plain text. gh auth setup-git already handles logins. Avoid git config credential.helper store.

• Flag fakes. At settings/keys, turn on Flag unsigned commits as unverified, so anyone faking commits as you shows up.

#Good habits

• Run gh auth status when unsure which account is active.
• Run git config user.email inside a repo before the first commit, to see which email it will use.
• If you add an email to the key later, re-upload the key to GitHub.
• Set a calendar reminder if your key expires. Renewing takes one command (backup.md).