Why You Should Ditch Personal Access Tokens
In August 2021, GitHub officially deprecated account passwords for Git operations over HTTPS, and GitLab followed suit with a similar policy. The two most common alternatives are SSH keys and Personal Access Tokens (PATs). While SSH keys are convenient on a dedicated personal machine, corporate Wi-Fi or office guest networks often block port 22. In those scenarios, HTTPS becomes your only way out.
Relying on HTTPS means having to deal with Personal Access Tokens—an experience that is notoriously frustrating. Every time you switch machines or a token expires, you have to open a browser, select individual permission scopes, and copy-paste a 40-character ghp_... string into your terminal. The worst-case scenario hits when you need to push an emergency hotfix to production at midnight, only for git push to fail with a 403 error because your 90-day token just expired. Many developers resort to saving tokens in plain text files or storing them in global Git configs, introducing a massive security risk to their source code.
When onboarding three new junior developers in the past, I lost half a morning simply walking each of them through generating tokens, checking the right repo scopes, and storing them locally. git-credential-oauth solves this headache once and for all. It is an open-source credential helper written in Go, weighing in at just around 6MB.
The tool brings the familiar OAuth 2.0 authentication flow straight to the command line. When you run a Git command, your default browser opens an authorization tab. Once you click Authorize, the token is securely stored directly in your OS keychain. You will never have to manually copy and paste a token string again.
Installation
Because it is built with Go and distributed as a standalone binary with no external runtime dependencies, installation takes only a few seconds.
On Ubuntu / Debian
# Ubuntu 23.04+ or Debian 12 (Bookworm)+:
sudo apt update
sudo apt install git-credential-oauth
# Older versions (download binary directly from GitHub Releases):
curl -s https://api.github.com/repos/hickford/git-credential-oauth/releases/latest \
| grep "browser_download_url.*linux_amd64.tar.gz" \
| cut -d : -f 2,3 \
| tr -d \" \
| wget -qi -
tar -xzf git-credential-oauth_*_linux_amd64.tar.gz
sudo mv git-credential-oauth /usr/local/bin/
rm git-credential-oauth_*_linux_amd64.tar.gzOn macOS (Homebrew)
brew install git-credential-oauthOn Arch Linux / Fedora
# Arch Linux
sudo pacman -S git-credential-oauth
# Fedora
sudo dnf install git-credential-oauthVerify Installation
Run this command to verify that the binary is recognized in your PATH:
git-credential-oauth --versionConfiguration
The greatest feature of git-credential-oauth is its auto-configuration command. It automatically detects existing secure credential stores on your system, such as Secret Service on Linux, Keychain on macOS, or Windows Credential Manager.
Step 1: Automatically Register the Helper with Git
git-credential-oauth configureInspect the directives newly added to your ~/.gitconfig file:
git config --global --get-all credential.helperThe terminal output typically displays a three-tier helper setup working in tandem:
cache --timeout=7200
oauth -device
libsecretHow it works: Git checks the secure storage layer (
libsecret,osxkeychain, ormanager) first. If a token does not exist or has expired, theoauthlayer opens your browser to request a fresh token and hands it over to the secure storage tier for safekeeping.
Step 2: Setup for Self-Hosted GitLab or Internal Gitea
By default, the tool supports GitHub, GitLab.com, Bitbucket, and Codeberg out of the box. If your company runs a private GitLab instance behind a VPN, specify its domain and the OAuth App Client ID in your Git configuration:
# Configure internal GitLab domain
git config --global credential.https://gitlab.mycompany.internal.helper oauth
git config --global credential.https://gitlab.mycompany.internal.oauthClientID "1234567890abcdef"Hands-on Experience & Session Management
Cloning a Private Repository for the First Time
Try cloning a private repository over HTTPS:
git clone https://github.com/my-org/core-service.gitYour terminal will display a brief prompt and automatically launch your default browser:
Opening in existing browser session.
Go to: https://github.com/login/oauth/authorize?client_id=...Click the green Authorize hickford/git-credential-oauth button in the browser. Authentication completes in a second via a localhost callback port, and the terminal proceeds to clone the repository normally—fast and seamless.
Working on Headless Servers (VPS via SSH)
You can still use this helper when connected to a remote server over SSH thanks to the -device flag (enabled by default by the configure command). This utilizes the standard OAuth Device Flow:
Please visit: https://github.com/login/device
And enter code: B8F2-4A1COpen a browser on your local machine, navigate to the URL, and enter the 8-character code. The remote VPS will receive the token immediately without requiring port forwarding or X11 forwarding.
Auditing and Revoking Access
Managing devices linked to your account is straightforward:
- From GitHub web UI: Navigate to Settings > Applications > Authorized OAuth Apps. You will see
git-credential-oauthlisted. If you misplace a laptop, simply click Revoke to invalidate its access immediately. - Clear tokens locally: To wipe stored credentials and re-authenticate from scratch, run:
printf "protocol=https\nhost=github.com\n" | git credential-oauth eraseA one-time two-minute setup eliminates manual token creation for good across your entire team—delivering better security and saving time otherwise lost on network troubleshooting.
