git credential

Used internally to fetch and store creds.

🎯 What & why

git credential is the plumbing Git uses to fetch, store, and reject credentials via helper programs. You almost never type it; you configure it.

🧠 Mental model

Git speaks a tiny key=value protocol on stdin/stdout to a helper binary. The helper decides where the secret lives — RAM, disk, keychain, or a remote vault.

🛠️ Synopsis

git credential <fill|approve|reject>

# Helper protocol (stdin):
#   protocol=https
#   host=github.com
#   username=alice
#   <blank line>
# Helper writes back username=... password=... on stdout.

git config --global credential.helper <helper>
git config --global credential.https://github.com.helper <helper>

🎚️ Switches & options

Flag	What it does
`fill`	Read a partial credential description, ask helpers to complete it
`approve`	Tell helpers a credential worked — store it
`reject`	Tell helpers a credential failed — erase it
`credential.helper=<bin>`	Configure a helper; multiple allowed, queried in order
`credential.useHttpPath=true`	Include URL path in the lookup key (per-repo creds)
`credential.helper=`	⚠️ Empty value RESETS the helper list — use to override system config

📦 Subcommands

fill — Complete a credential from helpers or prompt

echo -e 'protocol=https\nhost=github.com\n' | git credential fill

approve — Mark a credential as good so helpers cache it

git credential approve < cred.txt

reject — Tell helpers to forget a credential

git credential reject < cred.txt

💡 Use cases

Debugging why Git keeps prompting for a password.
Wiring a custom secrets backend (Vault, 1Password CLI) as a helper.
Scripting credential rotation without touching the keychain UI.
Forcing per-host helpers when one global helper is wrong.

🧪 Examples

Probe what Git would use

printf 'protocol=https\nhost=github.com\n\n' | git credential fill

List configured helpers

git config --get-all credential.helper

Set a helper for one host

git config --global credential.https://github.com.helper manager

Custom helper binary

git config --global credential.helper '/usr/local/bin/my-helper'

🎓 Recommendations

Use a real keychain helper on personal machines: osxkeychain, wincred, manager, or libsecret.
Set credential.helper per-host when you mix work and personal accounts.
Test with git credential fill before chasing phantom auth bugs.

🪤 Common pitfalls

Multiple credential.helper entries stack — adding one doesn't replace the previous.
An empty credential.helper= line is required to clear inherited config; many forget it.
Helpers are processes Git spawns — wrong PATH or permissions silently degrade to prompting.

🔗 Related modules

📝 Quiz

Hit each option, then Check answers. Score is recorded; Next is always open.