Git credential helpers quick reference
Helper types comparison
| Helper |
Storage type |
Security level |
Best use case |
cache |
In-memory daemon socket |
High (ephemeral, zero disk writes) |
CI runners, ephemeral containers, short sessions |
store |
Plaintext file (~/.git-credentials) |
Low (unencrypted disk file) |
Air-gapped machines, test environments |
libsecret |
Linux Secret Service API (Keyring) |
High (OS keychain encryption) |
Linux developer workstations |
osxkeychain |
macOS Keychain |
High (OS keychain encryption) |
macOS developer workstations |
wincred |
Windows Credential Manager |
High (OS keychain encryption) |
Windows developer workstations |
Custom script (!...) |
External vault, API, or JWT generator |
High (JIT rotation, no persistence) |
Enterprise CI/CD, Kubernetes pods |
Configuration commands
1. In-memory cache
# Set cache with 1-hour timeout
git config --global credential.helper "cache --timeout=3600"
# Set cache with custom socket path
git config --global credential.helper "cache --timeout=1800 --socket=/tmp/git-cache.sock"
# Terminate running cache daemon
git credential-cache exit
2. Plaintext store (with permission hardening)
# Configure store helper
git config --global credential.helper "store --file ~/.git-credentials"
# Restrict file permissions
touch ~/.git-credentials && chmod 600 ~/.git-credentials
3. Domain-scoped helper
# Scope helper to a specific internal Forgejo instance
git config --global credential."https://git.local.sneakysquid.xyz".helper "store --file=/secrets/forgejo.creds"
# Scope helper to a specific repository path
git config --global credential."https://github.com/my-org/private-repo.git".helper "!/usr/local/bin/vault-helper"
CI/CD runner one-liners
# Pass token per command
git -c http.extraHeader="Authorization: token $FORGEJO_TOKEN" clone https://git.local.sneakysquid.xyz/hermes/git-master.git
# Set global header for single host
git config --global http."https://git.local.sneakysquid.xyz/".extraHeader "Authorization: token $FORGEJO_TOKEN"
Pre-populating credentials in memory
# Seed cache without user interaction
printf "protocol=https\nhost=git.local.sneakysquid.xyz\nusername=oauth2\npassword=%s\n\n" "$FORGEJO_TOKEN" | git credential approve
Manual protocol debugging
Query credentials (fill)
printf "protocol=https\nhost=git.local.sneakysquid.xyz\n\n" | git credential fill
Store credentials (approve)
printf "protocol=https\nhost=git.local.sneakysquid.xyz\nusername=bot\npassword=token123\n\n" | git credential approve
Purge credentials (reject)
printf "protocol=https\nhost=git.local.sneakysquid.xyz\n\n" | git credential reject
Security audit one-liners
# Find plaintext tokens in local repository remotes
git config --local --get-regexp '^remote\..*\.url$' | grep -E 'https?://[^:]+:[^@]+@'
# Find plaintext tokens in global git config
git config --global --get-regexp '^remote\..*\.url$' | grep -E 'https?://[^:]+:[^@]+@'
# Remove hardcoded token from origin remote
git remote set-url origin "$(git remote get-url origin | sed -E 's|https://[^@]+@|https://|')"