git credential-cache

Caches creds for a few minutes.

🎯 What & why

git credential-cache keeps credentials in RAM via a small daemon, expiring them after a timeout. Convenient for short sessions; gone after logout.

🧠 Mental model

A unix-socket daemon holds the secrets. Git asks it via the credential protocol. No disk. No keychain. Pure volatility — that's the whole point.

🛠️ Synopsis

git config --global credential.helper 'cache'
git config --global credential.helper 'cache --timeout=3600'
git config --global credential.helper 'cache --socket=/tmp/git-cred-sock'

git credential-cache exit   # kill the daemon now
git credential-cache <get|store|erase>   # plumbing

🎚️ Switches & options

Flag	What it does
`--timeout=<secs>`	How long to keep creds; default 900 (15 min)
`--socket=<path>`	Custom socket location; default `~/.cache/git/credential/socket`
`get`	Plumbing: return cached cred for a description
`store`	Plumbing: cache a cred
`erase`	Plumbing: drop a cached cred
`exit`	⚠️ Kill the cache daemon immediately, dropping all cached creds

📦 Subcommands

exit — Stop the daemon; everything cached is lost

git credential-cache exit

get — Internal — fetch a cred (Git calls this)

git credential-cache get < desc.txt

store — Internal — store a cred (Git calls this)

git credential-cache store < cred.txt

erase — Internal — drop a cred (Git calls this)

git credential-cache erase < desc.txt

💡 Use cases

Shared machine where you don't want creds touching disk.
CI runner that should forget secrets when the job ends.
Long shell session where retyping a token gets old.
Locking creds to a single user via a per-user socket.

🧪 Examples

Cache for one hour

git config --global credential.helper 'cache --timeout=3600'

Custom socket path

git config --global credential.helper 'cache --socket=$XDG_RUNTIME_DIR/git-cred'

Force-flush the cache

git credential-cache exit

Inspect by probing

printf 'protocol=https\nhost=github.com\n\n' | git credential fill

🎓 Recommendations

Pick a timeout that matches your session length — 15 minutes is rarely the right answer.
Prefer a keychain helper for desktops; reserve cache for ephemeral or shared environments.
Use git credential-cache exit in logout scripts on shared boxes.

🪤 Common pitfalls

Doesn't survive logout, reboot, or daemon crash — by design, but surprising.
Default socket is per-user but world-readable directories can leak its existence; check perms on shared hosts.
Doesn't work on Windows native — use manager or wincred instead.

🔗 Related modules

📝 Quiz

Hit each option, then Check answers. Score is recorded; Next is always open.