cache

• Docs: https://git-scm.com/docs/git-credential-cache

• This helper is not included in the default git installer on Windows . :(

• This is how we can set up cache for a particular repository:

  ❯ mkdir foo
  ❯ cd foo
  ❯ git init .
  11:43:28.618841 git.c:444               trace: built-in: git init .
  Initialized empty Git repository in /private/tmp/foo/.git/
  
  ❯ git config --add credential.helper ""
  11:43:50.682962 git.c:444               trace: built-in: git config --add credential.helper ''
  
  ❯ git config --add credential.helper cache
  11:43:54.577707 git.c:444               trace: built-in: git config --add credential.helper cache
  
  ❯ cat .git/config
  [core]
      repositoryformatversion = 0
      filemode = true
      bare = false
      logallrefupdates = true
      ignorecase = true
      precomposeunicode = true
  [credential]
      helper =
      helper = cache

• Now let’s add credentials:

  ❯  (echo url=https://github.com; echo username=token; echo password=secret; echo ) | git credential approve
  11:45:16.813913 git.c:444               trace: built-in: git credential approve
  11:45:16.814431 run-command.c:663       trace: run_command: 'git credential-cache store'
  11:45:16.823008 git.c:704               trace: exec: git-credential-cache store
  11:45:16.823637 run-command.c:663       trace: run_command: git-credential-cache store
  11:45:16.842902 run-command.c:663       trace: run_command: git-credential-cache--daemon /Users/gaborcsardi/.cache/git/credential/socket
  
  ❯  (echo url=https://github.com; echo username=token2; echo password=secret2; echo ) | git credential approve
  11:45:28.927712 git.c:444               trace: built-in: git credential approve
  11:45:28.928108 run-command.c:663       trace: run_command: 'git credential-cache store'
  11:45:28.937087 git.c:704               trace: exec: git-credential-cache store
  11:45:28.937695 run-command.c:663       trace: run_command: git-credential-cache store

• Query with username works correctly:

  ❯ (echo url=https://token@github.com; echo ) | git credential fill
  11:46:40.689122 git.c:444               trace: built-in: git credential fill
  11:46:40.689638 run-command.c:663       trace: run_command: 'git credential-cache get'
  11:46:40.696784 git.c:704               trace: exec: git-credential-cache get
  11:46:40.697333 run-command.c:663       trace: run_command: git-credential-cache get
  protocol=https
  host=github.com
  username=token
  password=secret
  
  ❯ (echo url=https://token2@github.com; echo ) | git credential fill
  11:46:43.767002 git.c:444               trace: built-in: git credential fill
  11:46:43.767676 run-command.c:663       trace: run_command: 'git credential-cache get'
  11:46:43.778637 git.c:704               trace: exec: git-credential-cache get
  11:46:43.779201 run-command.c:663       trace: run_command: git-credential-cache get
  protocol=https
  host=github.com
  username=token2
  password=secret2

• Query without username works, and returns some credential:

  ❯ (echo url=https://github.com; echo ) | git credential fill
  11:45:58.200272 git.c:444               trace: built-in: git credential fill
  11:45:58.200667 run-command.c:663       trace: run_command: 'git credential-cache get'
  11:45:58.208372 git.c:704               trace: exec: git-credential-cache get
  11:45:58.208919 run-command.c:663       trace: run_command: git-credential-cache get
  protocol=https
  host=github.com
  username=token
  password=secret
  
  ❯ (echo url=https://token@github.com; echo ) | git credential reject
  11:47:03.921697 git.c:444               trace: built-in: git credential reject
  11:47:03.922530 run-command.c:663       trace: run_command: 'git credential-cache erase'
  11:47:03.935858 git.c:704               trace: exec: git-credential-cache erase
  11:47:03.936400 run-command.c:663       trace: run_command: git-credential-cache erase
  
  ❯ (echo url=https://github.com; echo ) | git credential fill
  11:47:10.018877 git.c:444               trace: built-in: git credential fill
  11:47:10.019386 run-command.c:663       trace: run_command: 'git credential-cache get'
  11:47:10.027990 git.c:704               trace: exec: git-credential-cache get
  11:47:10.028572 run-command.c:663       trace: run_command: git-credential-cache get
  protocol=https
  host=github.com
  username=token2
  password=secret2

store

• Docs: https://git-scm.com/docs/git-credential-store

• Configure for a repo:

  ❯ mkdir foo
  ❯ cd foo
  ❯ git init .
  11:53:48.042569 git.c:444               trace: built-in: git init .
  Initialized empty Git repository in /private/tmp/foo/.git/
  
  ❯ git config --add credential.helper ""
  11:53:52.949914 git.c:444               trace: built-in: git config --add credential.helper ''
  
  ❯ git config --add credential.helper store
  11:53:56.682348 git.c:444               trace: built-in: git config --add credential.helper store
  
  ❯ cat .git/config
  [core]
      repositoryformatversion = 0
      filemode = true
      bare = false
      logallrefupdates = true
      ignorecase = true
      precomposeunicode = true
  [credential]
      helper =
      helper = store

• Add credentials:

  ❯  (echo url=https://github.com; echo username=token; echo password=secret; echo ) | git credential approve
  11:54:44.184929 git.c:444               trace: built-in: git credential approve
  11:54:44.185729 run-command.c:663       trace: run_command: 'git credential-store store'
  11:54:44.197920 git.c:704               trace: exec: git-credential-store store
  11:54:44.198471 run-command.c:663       trace: run_command: git-credential-store store
  
  /tmp/foo master
  ❯  (echo url=https://github.com; echo username=token2; echo password=secret2; echo ) | git credential approve
  11:54:48.452942 git.c:444               trace: built-in: git credential approve
  11:54:48.453399 run-command.c:663       trace: run_command: 'git credential-store store'
  11:54:48.463535 git.c:704               trace: exec: git-credential-store store
  11:54:48.464004 run-command.c:663       trace: run_command: git-credential-store store

• Query with username:

  ❯ (echo url=https://token@github.com; echo ) | git credential fill
  11:55:21.191654 git.c:444               trace: built-in: git credential fill
  11:55:21.192357 run-command.c:663       trace: run_command: 'git credential-store get'
  11:55:21.204279 git.c:704               trace: exec: git-credential-store get
  11:55:21.205063 run-command.c:663       trace: run_command: git-credential-store get
  protocol=https
  host=github.com
  username=token
  password=secret
  
  ❯ (echo url=https://token2@github.com; echo ) | git credential fill
  11:55:24.194096 git.c:444               trace: built-in: git credential fill
  11:55:24.194654 run-command.c:663       trace: run_command: 'git credential-store get'
  11:55:24.207028 git.c:704               trace: exec: git-credential-store get
  11:55:24.207643 run-command.c:663       trace: run_command: git-credential-store get
  protocol=https
  host=github.com
  username=token2
  password=secret2

• Query without username returns some credentials, apparently not the ones that were set first:

  ❯ (echo url=https://github.com; echo ) | git credential fill
  11:56:12.394594 git.c:444               trace: built-in: git credential fill
  11:56:12.394949 run-command.c:663       trace: run_command: 'git credential-store get'
  11:56:12.403303 git.c:704               trace: exec: git-credential-store get
  11:56:12.403863 run-command.c:663       trace: run_command: git-credential-store get
  protocol=https
  host=github.com
  username=token2
  password=secret2
  
  ❯ (echo url=https://token2@github.com; echo ) | git credential reject
  11:56:24.065910 git.c:444               trace: built-in: git credential reject
  11:56:24.066314 run-command.c:663       trace: run_command: 'git credential-store erase'
  11:56:24.074851 git.c:704               trace: exec: git-credential-store erase
  11:56:24.076875 run-command.c:663       trace: run_command: git-credential-store erase
  
  ❯ (echo url=https://github.com; echo ) | git credential fill
  11:56:26.438444 git.c:444               trace: built-in: git credential fill
  11:56:26.438839 run-command.c:663       trace: run_command: 'git credential-store get'
  11:56:26.446181 git.c:704               trace: exec: git-credential-store get
  11:56:26.446721 run-command.c:663       trace: run_command: git-credential-store get
  protocol=https
  host=github.com
  username=token
  password=secret

osxkeychain

• Some docs: https://docs.github.com/en/github/using-git/updating-credentials-from-the-osx-keychain

• This is the default helper on macOS currently (git 2.28.0).

• This is how it stores a credential:

  Name: github.com
  Kind: Internet password
  Account: token
  Where: https://github.com

• It installs as a git subcommand, so it is possible to call its internal api directly:

  ❯ git credential-osxkeychain
  11:50:56.325499 git.c:704               trace: exec: git-credential-osxkeychain
  11:50:56.325783 run-command.c:663       trace: run_command: git-credential-osxkeychain
  usage: git credential-osxkeychain <get|store|erase>

• As always, needs username when setting the credential.

• No need to supply username to get some token that matches the host. This is in a clean keychain. First we set two credentials:

  ❯ (echo url=https://github.com; echo username=token; echo password=secret; echo ) | git credential approve
  10:48:47.187164 git.c:444               trace: built-in: git credential approve
  10:48:47.187691 run-command.c:663       trace: run_command: 'git credential-osxkeychain store'
  10:48:47.197964 git.c:704               trace: exec: git-credential-osxkeychain store
  10:48:47.198518 run-command.c:663       trace: run_command: git-credential-osxkeychain store
  
  ❯ (echo url=https://github.com; echo username=token2; echo password=secret2; echo ) | git credential approve
  10:48:55.299933 git.c:444               trace: built-in: git credential approve
  10:48:55.300282 run-command.c:663       trace: run_command: 'git credential-osxkeychain store'
  10:48:55.308568 git.c:704               trace: exec: git-credential-osxkeychain store
  10:48:55.309276 run-command.c:663       trace: run_command: git-credential-osxkeychain store

  If we don’t supply a username, then we’ll just get one of them:

  ❯ (echo url=https://github.com; echo ) | git credential fill
  10:49:17.371636 git.c:444               trace: built-in: git credential fill
  10:49:17.372021 run-command.c:663       trace: run_command: 'git credential-osxkeychain get'
  10:49:17.378688 git.c:704               trace: exec: git-credential-osxkeychain get
  10:49:17.379164 run-command.c:663       trace: run_command: git-credential-osxkeychain get
  protocol=https
  host=github.com
  username=token
  password=secret

  If we supply the username, then we’ll get the correct one:

  ❯ (echo url=https://token2@github.com; echo ) | git credential fill
  10:49:28.613779 git.c:444               trace: built-in: git credential fill
  10:49:28.614108 run-command.c:663       trace: run_command: 'git credential-osxkeychain get'
  10:49:28.621440 git.c:704               trace: exec: git-credential-osxkeychain get
  10:49:28.621979 run-command.c:663       trace: run_command: git-credential-osxkeychain get
  protocol=https
  host=github.com
  username=token2
  password=secret2

  To check that without a username we get an arbitrary one, let’s remove token:

  ❯ (echo url=https://token@github.com; echo ) | git credential reject
  10:49:58.584332 git.c:444               trace: built-in: git credential reject
  10:49:58.586880 run-command.c:663       trace: run_command: 'git credential-osxkeychain erase'
  10:49:58.598463 git.c:704               trace: exec: git-credential-osxkeychain erase
  10:49:58.599214 run-command.c:663       trace: run_command: git-credential-osxkeychain erase
  
  ```sh
  ❯ (echo url=https://github.com; echo ) | git credential fill
  10:50:07.468385 git.c:444               trace: built-in: git credential fill
  10:50:07.468728 run-command.c:663       trace: run_command: 'git credential-osxkeychain get'
  10:50:07.478398 git.c:704               trace: exec: git-credential-osxkeychain get
  10:50:07.478832 run-command.c:663       trace: run_command: git-credential-osxkeychain get
  protocol=https
  host=github.com
  username=token2
  password=secret2

  Now let’s re-add token to make sure that osxkeychain does not prefer token:

  ❯ (echo url=https://github.com; echo username=token; echo password=secret; echo ) | git credential approve
  10:58:52.302066 git.c:444               trace: built-in: git credential approve
  10:58:52.311063 run-command.c:663       trace: run_command: 'git credential-osxkeychain store'
  10:58:52.321633 git.c:704               trace: exec: git-credential-osxkeychain store
  10:58:52.322108 run-command.c:663       trace: run_command: git-credential-osxkeychain store
  
  ❯ (echo url=https://github.com; echo ) | git credential fill
  10:58:57.316418 git.c:444               trace: built-in: git credential fill
  10:58:57.317630 run-command.c:663       trace: run_command: 'git credential-osxkeychain get'
  10:58:57.330142 git.c:704               trace: exec: git-credential-osxkeychain get
  10:58:57.330697 run-command.c:663       trace: run_command: git-credential-osxkeychain get
  protocol=https
  host=github.com
  username=token2
  password=secret2

  So it seems that osxkeychain will just find an arbitrary one, or the one that was added first.

manager-core (on macOS), before version 2.0.246-beta

• Not installed by default (git 2.28.0).

• Install from brew, according to the instructions: https://github.com/GitCredentialManager/git-credential-manager#macos-homebrew

• If updates your global git config, adding these lines:

  [credential]
      helper = ""
  [credential "https://dev.azure.com"]
      useHttpPath = true
  [credential]
      helper = manager-core

  The helper = "" line deletes previous handlers. The system helper is kept as osxkeychain.

• It installs as a git subcommand, and you can call its internal API directly:

  ❯ git credential-manager-core
  11:51:56.434300 git.c:704               trace: exec: git-credential-manager-core
  11:51:56.434496 run-command.c:663       trace: run_command: git-credential-manager-core
  Missing command.
  
  usage: git-credential-manager-core <command>
  
    Available commands:
      erase
      get
      store
  
      configure [--system]
      unconfigure [--system]
  
      --version, version
      --help, -h, -?

• It is not compatible with the osxkeychain helper, because it uses different keys in the keychain.

• It supports different providers. Providers are auto-detected by default. GitHub has its own provider, detected via the github.com URL. The provider can be configured user a git config key or an environment variable: https://github.com/GitCredentialManager/git-credential-manager/blob/master/docs/configuration.md

• It does not currently supports namepaces (like manager).

• This is how it stores a credential:

  Name: git:https://github.com
  Kind: application password
  Account: token
  Where: git:https://github.com

• No need to supply username to get some credential:

  ❯ (echo url=https://github.com; echo ) | git credential fill
  11:24:47.750966 git.c:444               trace: built-in: git credential fill
  11:24:47.753268 run-command.c:663       trace: run_command: 'git credential-manager-core get'
  11:24:47.762249 git.c:704               trace: exec: git-credential-manager-core get
  11:24:47.762917 run-command.c:663       trace: run_command: git-credential-manager-core get
  protocol=https
  host=github.com
  username=token
  password=secret

• If there are multiple credentials, a random one (or the one set first?) is returned:

  ❯  (echo url=https://github.com; echo username=token2; echo password=secret2; echo ) | git credential approve
  11:25:41.553761 git.c:444               trace: built-in: git credential approve
  11:25:41.554242 run-command.c:663       trace: run_command: 'git credential-manager-core store'
  11:25:41.565748 git.c:704               trace: exec: git-credential-manager-core store
  11:25:41.566218 run-command.c:663       trace: run_command: git-credential-manager-core store

• In fact the username is completely ignored when getting credentials, at least for the GitHub provider:

  ❯ (echo url=https://token2@github.com; echo ) | git credential fill
  11:29:49.274574 git.c:444               trace: built-in: git credential fill
  11:29:49.275020 run-command.c:663       trace: run_command: 'git credential-manager-core get'
  11:29:49.283563 git.c:704               trace: exec: git-credential-manager-core get
  11:29:49.284236 run-command.c:663       trace: run_command: git-credential-manager-core get
  protocol=https
  host=github.com
  username=token
  password=secret

  This is because the username is not stored as part of the URL by the GitHub provider. Related issue: https://github.com/GitCredentialManager/git-credential-manager/issues/160 manager has a similar problem, it is linked from this GitHub issue.

• If you set the provider to Generic, then usernames work as expected. In this case, this is stored in the keychain:

  Name: git:https://token@github.com/
  Kind: application password
  Account: token
  Where: git:https://token@github.com/

  These credentials are not compatible with the ones set by the GitHub provider.

  ❯ export GCM_PROVIDER=generic
  
  ❯  (echo url=https://github.com; echo username=token; echo password=secret; echo ) | git credential approve
  11:34:15.998644 git.c:444               trace: built-in: git credential approve
  11:34:15.998992 run-command.c:663       trace: run_command: 'git credential-manager-core store'
  11:34:16.008178 git.c:704               trace: exec: git-credential-manager-core store
  11:34:16.008834 run-command.c:663       trace: run_command: git-credential-manager-core store
  
  ❯  (echo url=https://github.com; echo username=token2; echo password=secret2; echo ) | git credential approve
  11:35:52.629963 git.c:444               trace: built-in: git credential approve
  11:35:52.637966 run-command.c:663       trace: run_command: 'git credential-manager-core store'
  11:35:52.648058 git.c:704               trace: exec: git-credential-manager-core store
  11:35:52.648514 run-command.c:663       trace: run_command: git-credential-manager-core store
  
  ❯ (echo url=https://token@github.com; echo ) | git credential fill
  11:35:58.336428 git.c:444               trace: built-in: git credential fill
  11:35:58.336881 run-command.c:663       trace: run_command: 'git credential-manager-core get'
  11:35:58.345187 git.c:704               trace: exec: git-credential-manager-core get
  11:35:58.345729 run-command.c:663       trace: run_command: git-credential-manager-core get
  protocol=https
  host=github.com
  username=token
  password=secret
  
  ❯ (echo url=https://token2@github.com; echo ) | git credential fill
  11:36:02.550339 git.c:444               trace: built-in: git credential fill
  11:36:02.550695 run-command.c:663       trace: run_command: 'git credential-manager-core get'
  11:36:02.557777 git.c:704               trace: exec: git-credential-manager-core get
  11:36:02.558359 run-command.c:663       trace: run_command: git-credential-manager-core get
  protocol=https
  host=github.com
  username=token2
  password=secret2

manager-core (macOS), 2.0.246-beta or later

• This version adds better support for multiple credentials for the same host.
• It does not save the username as part of the service any more, for the generic provider.
• It does save the username as account and it uses it when searching for credentials, both for the generic and the github provider.

manager (GitHub authority)

• This was Git Credential Manager for Windows, and it is the default helper on Windows for git 2.28.0. In git 2.29.0 it is not the default any more, and it is deprecated in favor of manager-core. It is still installed, though.

• Docs: https://github.com/Microsoft/Git-Credential-Manager-for-Windows

• It is installed as a git subcommand, so it can be called directly:

  ❯ $env:GIT_TRACE="true"
  ❯ git credential-manager
  12:15:45.554298 exec-cmd.c:237          trace: resolved executable dir: C:/Program Files/Git/mingw64/bin
  12:15:45.556249 git.c:704               trace: exec: git-credential-manager
  12:15:45.556249 run-command.c:663       trace: run_command: git-credential-manager
  usage: git-credential-manager.exe [approve|clear|config|delete|deploy|erase|fill|get|install|reject|remove|store|uninstall|version] [<args>]
  fatal: Unable to open help documentation.

• Setting credentials. The username must be provided, and it is stored in the credential, but the GitHub provider overwrites credentials with the same host name, even if they have a different username. I.e. after this, there will be only one credential:

  ❯  %  { echo url=https://github.com; echo username=token; echo password=secret; echo "" } | git credential approve
  13:16:58.118611 exec-cmd.c:237          trace: resolved executable dir: C:/Program Files/Git/mingw64/bin
  13:16:58.120617 git.c:444               trace: built-in: git credential approve
  13:16:58.122612 run-command.c:663       trace: run_command: 'git credential-manager store'
  13:16:58.170625 exec-cmd.c:237          trace: resolved executable dir: C:/Program Files/Git/mingw64/libexec/git-core
  13:16:58.173087 git.c:704               trace: exec: git-credential-manager store
  13:16:58.173087 run-command.c:663       trace: run_command: git-credential-manager store
  
  ❯  %  { echo url=https://github.com; echo username=token2; echo password=secret2; echo "" } | git credential approve
  13:17:30.925970 exec-cmd.c:237          trace: resolved executable dir: C:/Program Files/Git/mingw64/bin
  13:17:30.928134 git.c:444               trace: built-in: git credential approve
  13:17:30.928987 run-command.c:663       trace: run_command: 'git credential-manager store'
  13:17:30.968981 exec-cmd.c:237          trace: resolved executable dir: C:/Program Files/Git/mingw64/libexec/git-core
  13:17:30.970974 git.c:704               trace: exec: git-credential-manager store
  13:17:30.970974 run-command.c:663       trace: run_command: git-credential-manager store

• It stores credentials in the following format:

  Internet or network address: git:https://github.com
  User name: token
  Password: ****
  Persistence: Local computer

<!- - –>

• It has multiple authorities, (like providers for manager-core). The GitHub authority is used for github.com URLs by default. The authority can be set with a config option or an env var.

• We need to set the GCM_VALIDATE env var to false , otherwise it tries to validate the GitHub token every time we query it.

  ❯ $env:GCM_VALIDATE="false"

• No username is needed for getting the credential, for the GitHub provider.

  ❯  %  { echo url=https://github.com; echo "" } | git credential fill
  13:24:43.831089 exec-cmd.c:237          trace: resolved executable dir: C:/Program Files/Git/mingw64/bin
  13:24:43.833666 git.c:444               trace: built-in: git credential fill
  13:24:43.834092 run-command.c:663       trace: run_command: 'git credential-manager get'
  13:24:43.872087 exec-cmd.c:237          trace: resolved executable dir: C:/Program Files/Git/mingw64/libexec/git-core
  13:24:43.874092 git.c:704               trace: exec: git-credential-manager get
  13:24:43.874092 run-command.c:663       trace: run_command: git-credential-manager get
  protocol=https
  host=github.com
  path=
  username=token2
  password=secret2

  In fact the username is ignored for the GitHub provider:

  ❯ %  { echo url=https://token@github.com; echo "" } | git credential fill
  13:25:06.029084 exec-cmd.c:237          trace: resolved executable dir: C:/Program Files/Git/mingw64/bin
  13:25:06.031084 git.c:444               trace: built-in: git credential fill
  13:25:06.032081 run-command.c:663       trace: run_command: 'git credential-manager get'
  13:25:06.069085 exec-cmd.c:237          trace: resolved executable dir: C:/Program Files/Git/mingw64/libexec/git-core
  13:25:06.070086 git.c:704               trace: exec: git-credential-manager get
  13:25:06.070086 run-command.c:663       trace: run_command: git-credential-manager get
  protocol=https
  host=github.com
  path=
  username=token2
  password=secret2

• Supports namespaces, the default namespace is git. The namespace is included in the name of the credential: namespace:URL.

• There is a pull request to include the username in the URL as well: https://github.com/microsoft/Git-Credential-Manager-for-Windows/pull/891

manager (Basic authority)

• Basic authority can be configured with an env var or config option:

  ❯ $env:GCM_AUTHORITY="Basic"

• It is compatible with the credentials set by the GitHub authority:

  ❯  %  { echo url=https://github.com; echo "" } | git credential fill
  13:27:17.344396 exec-cmd.c:237          trace: resolved executable dir: C:/Program Files/Git/mingw64/bin
  13:27:17.346397 git.c:444               trace: built-in: git credential fill
  13:27:17.347388 run-command.c:663       trace: run_command: 'git credential-manager get'
  13:27:17.386388 exec-cmd.c:237          trace: resolved executable dir: C:/Program Files/Git/mingw64/libexec/git-core
  13:27:17.388386 git.c:704               trace: exec: git-credential-manager get
  13:27:17.388386 run-command.c:663       trace: run_command: git-credential-manager get
  protocol=https
  host=github.com
  path=
  username=token2
  password=secret2

• But it supports usernames as well. Note that since the username is stored in the URL, it does not return some arbitrary credentials if we query the URL without a username. We need to tell GCM here not to ask for a password, but just fall back to the next credential helper.

  ❯ $env:GCM_INTERACTIVE="Never"
  
  ❯ % { echo url=https://token2@github.com; echo "" } | git -c credential.helper="! echo protocol=dummy; echo host=dummy;
   echo username=dummy; echo password=dummy" credential fill
  13:31:16.682545 exec-cmd.c:237          trace: resolved executable dir: C:/Program Files/Git/mingw64/bin
  13:31:16.684473 git.c:444               trace: built-in: git credential fill
  13:31:16.685471 run-command.c:663       trace: run_command: 'git credential-manager get'
  13:31:16.725486 exec-cmd.c:237          trace: resolved executable dir: C:/Program Files/Git/mingw64/libexec/git-core
  13:31:16.727472 git.c:704               trace: exec: git-credential-manager get
  13:31:16.727472 run-command.c:663       trace: run_command: git-credential-manager get
  Logon failed, use ctrl+c to cancel basic credential prompt.
  13:31:16.948468 run-command.c:663       trace: run_command: ' echo protocol=dummy; echo host=dummy; echo username=dummy; echo password=dummy get'
  protocol=dummy
  host=dummy
  username=dummy
  password=dummy get

• When setting credentials, usernames are included in the URL:

  ❯ % { echo url=https://github.com; echo username=token; echo password=secret; echo "" } | git credential approve
  13:34:37.937934 exec-cmd.c:237          trace: resolved executable dir: C:/Program Files/Git/mingw64/bin
  13:34:37.940820 git.c:444               trace: built-in: git credential approve
  13:34:37.940995 run-command.c:663       trace: run_command: 'git credential-manager store'
  13:34:37.983372 exec-cmd.c:237          trace: resolved executable dir: C:/Program Files/Git/mingw64/libexec/git-core
  13:34:37.984737 git.c:704               trace: exec: git-credential-manager store
  13:34:37.984737 run-command.c:663       trace: run_command: git-credential-manager store

  will create this record in the credential store:

  Internet or network address: git:https://token@github.com
  User name: token
  Password: ****
  Persistence: Local computer

  and then this can be queried with an explicit username:

  ❯  %  { echo url=https://token@github.com; echo "" } | git -c credential.helper="! echo protocol=dummy; echo host=dummy; echo username=dummy; echo password=dummy" credential fill
  13:36:42.789268 exec-cmd.c:237          trace: resolved executable dir: C:/Program Files/Git/mingw64/bin
  13:36:42.791270 git.c:444               trace: built-in: git credential fill
  13:36:42.792266 run-command.c:663       trace: run_command: 'git credential-manager get'
  13:36:42.830475 exec-cmd.c:237          trace: resolved executable dir: C:/Program Files/Git/mingw64/libexec/git-core
  13:36:42.832279 git.c:704               trace: exec: git-credential-manager get
  13:36:42.832279 run-command.c:663       trace: run_command: git-credential-manager get
  protocol=https
  host=github.com
  path=
  username=token
  password=secret

manager-core (on Windows, before version 2.0.246-beta)

• Not installed by default (git 2.28.0), but this is supposed to be the future canonical implementation. See above for the macOS version.

• It works similarly to manager , I haven’t seen any differences in behavior (version was 2.0.194.40577). Instead of authorities, we need to set up providers: https://github.com/GitCredentialManager/git-credential-manager/blob/master/docs/migration.md. The Generic provider works the same way as the Basic authority in manager.

• Unfortunately setting GCM_AUTHORITY will make manager-core break, so it is not possible to use both manager and manager-core if you need to set this environment variable.

manager-core (on Windows, from 2.0.246-beta)

• This is now the version that is the default helper in git 2.29.0 and later. manager is still installed, but the default system config sets manager-core.
• It supports multiple users better: https://github.com/GitCredentialManager/git-credential-manager/issues/160#issuecomment-700544889
• When storing a credential, it first checks if there is a target name without a username. If there is, then it uses the target name without the username. It stores the username in the username field of the credential, still. so it is not lost.
• When looking up a credential without a username, it will return the first credential it can find, even if the target name contains a username, and there is another credential without a username in the target name.
• When looking up a credential with a username, it may return any credential with a matching username, and a target name that matches the host. The username inside the target name does not actually matter.

macOS

1. Use the osxkeychain helper.

2. FIrst remove all your current credentials for the host you are targeting. E.g. for GitHub, search for “Internet Passwords” for github.com, or use gitcreds::gitcreds_list() and the oskeyring package to remove them. You can also use the oskeyring package to back up the tokens and passwords.

3. Then add the credential that you want to use for “generic access”. This is the credential that will be used for URLs without user names. The user name for this credential does not matter, but you can choose something descriptive, e.g. “PersonalAccessToken”, “token”, or “generic”.

4. Configure git to use this username by default. E.g. if you chose “generic”, then run

   git config --global credential.username generic

5. Add all the other credentials, with appropriate user names. These are the user names that you need to put in the URLs for the repositories or operations you want to use them for. (GitHub does not actually use the user names if the password is a PAT.)

Windows, with git 2.29.0 or later and manager-core

1. We suggest that you update to the latest git version, but at least 2.29.0, and use the manager-core helper which is now default. If you installed manager-core separately from git, we suggest that you remove it, because it might cause confusion as to which helper is actually used.

2. Remove all current credentials first, for the host you are targeting. You can do this in ‘Credential Manager’ or gitcreds::gitcreds_list() to find them and the oskeyring package to remove them. You can also use the oskeyring packaeg to back up the tokens and passwords.

3. Then add the credential that you want to use for “generic access”. This is the credential that will be used for URLs without user names. The user name for this credential does not matter, but you can choose something descriptive, e.g. “PersonalAccessToken”, “token”, or “generic”.

4. Configure git to use this username by default. E.g. if you chose “generic”, then run

   git config –global credential.username generic

5. Add all the other credentials, with appropriate user names. These are the user names that you need to put in the URLs for the repositories or operations you want to use them for. (GitHub does not actually use the user names if the password is a PAT.)

Windows with older git versions

git config --global credential.https://example.com.username myusername

git config --global credential.authority Basic

git config --global credential.github.com.authority Basic

git config --global credential.username generic