GitHub most likely has protective rate limits for anonymous HTTPS traffic. It is a service exposed to the wide and hostile internet, after all. SSH is likely not as heavily rate limited because 1) it's authenticated by default, and 2) it's harder to write "SSH middleware" compared to throwing a throttle on HTTPS. Theoretically, HTTPS traffic using tokens for authorization should tick the authenticated box. BUT, some Git-over-HTTPS libraries have a quirky request flow where they first send an unauthenticated request and then retry with the token auth header if the server responds with

HTTP 401 Unauthorized

. It's dumb and wasteful, but GitHub's very own

libgit2

library does it this way 🤷 All of that is a long-winded way of saying: stick to using SSH if you can, it just has fewer operational bugbears to deal with.