Credential managers and storage

Why this matters

You paste a token once and never think about it again, which is exactly the problem on the day the token is wrong. Git keeps asking nothing and keeps failing, because something is answering on your behalf. Knowing where that something stores the answer turns a maddening loop into a one-line fix.

What a helper is

Which one you have:

$ git config --list --show-origin | grep credential

file:/Applications/Xcode.app/Contents/Developer/usr/share/git-core/gitconfig	credential.helper=osxkeychain

On this Mac the helper comes from Git's own system configuration, which is why nothing was set in ~/.gitconfig. If the command prints nothing, no helper is configured and you are asked every time.

To set one:

$ git config --global credential.helper osxkeychain     # macOS
$ git config --global credential.helper manager          # Windows
$ git config --global credential.helper libsecret        # Linux

Removing a stored credential

This is the fix for the repeating error. Choose your platform:

macOS. Open Keychain Access, search for gitlab.com or github.com, and delete the "internet password" entry. Or from the terminal:

$ printf 'protocol=https\nhost=gitlab.com\n\n' | git credential-osxkeychain erase

Windows. Open Credential Manager (Control Panel → User Accounts → Credential Manager) → Windows Credentials, find git:https://gitlab.com, and remove it. Or:

$ printf 'protocol=https\nhost=gitlab.com\n\n' | git credential-manager erase

Linux with libsecret. Use Seahorse ("Passwords and Keys") and delete the entry for the host, or:

$ printf 'protocol=https\nhost=gitlab.com\n\n' | git credential-libsecret erase

remote: HTTP Basic: Access denied. The provided password or token is incorrect or your account has 2FA enabled and you must use a personal access token instead of a password.
fatal: Authentication failed for 'https://gitlab.com/northwind-trails/trailguide.git/'

With store. Edit ~/.git-credentials and delete the line for that host.

The blank line at the end of each printf is required: it tells the helper the input is finished. After erasing, the next push asks for the username and token again.

The repeating-error pattern

If this appears again immediately after you created a fresh token, you almost certainly did not get the chance to type it: the helper answered first, with the old one. The sequence that always works:

1. Create the new token and copy it.
2. Erase the stored credential for that host, with the command for your system above.
3. Push. Git asks for the username and password.
4. Paste the new token.

How to do it

$ git config --list --show-origin | grep credential
$ printf 'protocol=https\nhost=gitlab.com\n\n' | git credential-osxkeychain erase
$ git push

Common mistakes

• Making new tokens without erasing the old credential. The classic loop. Erase first.
• Assuming there is one credential. The helper, VS Code's account and IntelliJ's safe are three separate stores.
• Using store on a work machine. A plain-text token file; use the keychain.
• Forgetting the blank line in the erase command, which then waits for more input; press Ctrl+D and try again with the newline.
• Erasing the credential for the wrong host. gitlab.com and gitlab.company.com are different entries.