A Git credential helper that securely authenticates to GitHub, GitLab and BitBucket using OAuth.
git-credential-oauth is a Git credential helper designed to securely authenticate with GitHub, GitLab, BitBucket, and Gerrit using OAuth. This tool eliminates the need for passwords, personal access tokens, or SSH keys by leveraging OAuth for secure authentication.
Key Features:
Secure Authentication: Uses OAuth to provide secure access across multiple platforms.
Convenience: No longer requires managing passwords, tokens, or SSH keys.
Browser Integration: Opens a browser window for initial setup and handles subsequent authentications without user interaction within the storage timeframe.
Device Flow Support: Facilitates authentication on systems without a web browser using OAuth device flow.
Audience & Benefits:
Ideal for developers and teams managing Git repositories across platforms like GitHub, GitLab, BitBucket, and Gerrit. This tool offers secure, seamless authentication, reducing the need for manual token management and enhancing workflow efficiency through integrated support with various Git environments.
README
git-credential-oauth
No more passwords! No more personal access tokens! No more SSH keys!
git-credential-oauth is a Git credential helper that securely authenticates to GitHub, GitLab, BitBucket and Gerrit using OAuth.
The first time you authenticate, the helper opens a browser window to the host.
Subsequent authentication within storage lifetime is non interactive.
Motivation
Git assumes users can type a password from memory, but hosts such as GitHub no longer accept passwords without two-factor authentication.
Personal access tokens are easy enough to copy and paste but awkward to store securely.
git-credential-cache works well for passwords but not personal access tokens because the token is lost when the cache expires.
All in all, the usability is so poor that the most popular advice on StackOverflow is to insecurely save credentials in plaintext!
OAuth has multiple advantages over personal access tokens or SSH:
Go users can install the latest release to ~/go/bin with:
go install github.com/hickford/git-credential-oauth@latest
Configuration
As a convenience, you can run:
git credential-oauth configure
This uses the recommended config below.
How it works
Git is cleverly designed to support multiple credential helpers. To fill credentials, Git calls each helper in turn until it has the information it needs. git-credential-oauth is a read-only credential-generating helper, designed to be configured in combination with a storage helper.
You may choose a different storage helper such as osxkeychain, wincred or libsecret, but git-credential-oauth must be configured last. This ensures Git checks for stored credentials before generating new credentials.
Windows users are recommended to use storage helper wincred.
Manual config
Edit your global git config~/.gitconfig to include the following lines:
Check Git remote URL git remote -v does not contain a username.
Test git-credential-oauth in verbose mode for your specific hostprintf host=example.com\nprotocol=https\n | git-credential-oauth -verbose get. Set any config keys suggested.
GitHub organizations
Some GitHub organizations require users to manually request approval for the app:
