How can I save username and password in Git?

Learn how can i save username and password in git? with practical examples, diagrams, and best practices. Covers git, credentials, git-config development techniques with visual explanations.
Tags:
Categories:

Securely Storing Git Credentials: A Comprehensive Guide

Hero image for How can I save username and password in Git?

Learn how to save your Git username and password to avoid repeated prompts, enhancing your workflow while maintaining security. This guide covers various credential helpers and best practices.

Repeatedly entering your username and password for Git operations can be tedious and disruptive to your development flow. Git provides several mechanisms, known as credential helpers, to securely store your authentication details, allowing you to interact with remote repositories without constant re-authentication. This article will guide you through the most common and recommended methods for saving your Git credentials, ensuring both convenience and security.

Understanding Git Credential Helpers

Git credential helpers are programs that Git invokes when it needs authentication details for a remote repository. Instead of prompting you every time, Git asks the helper, which can then provide the stored credentials. This system allows for flexible and secure storage options, from in-memory caching to platform-specific secure storage solutions.

flowchart TD
    A[Git Command (e.g., git push)] --> B{Authentication Needed?}
    B -->|Yes| C[Invoke Credential Helper]
    C --> D{Credentials Stored?}
    D -->|Yes| E[Retrieve Credentials]
    D -->|No| F[Prompt User for Credentials]
    E --> G[Authenticate with Remote]
    F --> H[Store Credentials (Optional)]
    G --> I[Operation Successful]
    H --> G

Git Credential Helper Workflow

Configuring Credential Helpers

The primary way to configure how Git handles credentials is through the git config command. You can set a global credential helper that applies to all your repositories, or a local one for specific projects. The choice of helper depends on your operating system and security requirements.

macOS

On macOS, the osxkeychain helper is recommended. It stores credentials securely in the macOS Keychain.

git config --global credential.helper osxkeychain

Windows (Git Credential Manager)

For Windows, the Git Credential Manager (GCM) is the standard and most secure option. It integrates with Windows Credential Manager, Azure Active Directory, and other services.

If you installed Git for Windows, GCM is usually included and configured by default. If not, you can install it separately.

git config --global credential.helper manager

Linux (cache)

On Linux, cache is a common helper that stores credentials in memory for a short period. This is less secure than platform-specific options but more convenient than no helper.

git config --global credential.helper cache

To set a timeout (e.g., 1 hour):

git config --global credential.helper 'cache --timeout=3600'

For more secure options on Linux, consider libsecret (GNOME Keyring) or pass (password store).

Using Git Credential Manager (GCM) for Enhanced Security

Git Credential Manager (GCM) is a cross-platform credential helper that simplifies authentication to Git repositories, especially those hosted on Azure DevOps, GitHub, Bitbucket, and GitLab. It supports various authentication methods, including OAuth tokens, personal access tokens, and basic authentication, and stores them securely using OS-native credential stores.

1. Install Git Credential Manager

If you installed Git for Windows, GCM is likely already installed. For macOS and Linux, you can install it via Homebrew or by downloading the latest release from the official GitHub repository.

macOS (Homebrew):

brew install git-credential-manager

Linux (Debian/Ubuntu):

sudo apt install git-credential-manager

2. Configure Git to use GCM

Once installed, configure Git to use GCM as its credential helper. This command tells Git to use the manager helper, which will invoke GCM.

git config --global credential.helper manager

3. Perform a Git operation

The next time you perform a Git operation that requires authentication (e.g., git push, git pull from a private repo), GCM will intercept the request. It will either retrieve existing credentials or prompt you to authenticate via a browser or a dialog, then securely store the generated token or password.

Removing Stored Credentials

If you need to remove stored credentials, for example, after changing your password or if you're switching accounts, you can do so through the credential helper or by directly clearing the stored entry.

git credential-osxkeychain erase
# host=github.com
# protocol=https

# Or for Git Credential Manager (Windows/cross-platform)
git credential-manager erase
# host=github.com
# protocol=https

Example of erasing credentials for a specific host

For Git Credential Manager, you can also manage credentials directly through your operating system's credential manager (e.g., Windows Credential Manager, macOS Keychain Access).