thde.io

git-credential-oauth: OAuth for Git

2026-11-02T00:00:00+00:00

git-credential-oauth is a Git credential helper that authenticates to GitHub, GitLab, Bitbucket, and other forges using OAuth. On your first push or pull, it opens a browser tab to authenticate, then a storage helper caches the token for subsequent commands, so you don’t need to create, rotate, or paste personal access tokens.

Installation

brew install git-credential-oauth

Configuration

Git supports chaining credential helpers, evaluating them in order until one provides valid credentials. In this setup, git-credential-oauth acquires OAuth tokens, while a storage helper like osxkeychain caches them locally.

The order matters: the storage helper must come first so Git checks stored credentials before starting a new OAuth flow. On macOS, Homebrew’s Git already configures osxkeychain in its system config (/opt/homebrew/etc/gitconfig), and Git reads the system config before ~/.gitconfig. So adding oauth to your global config is enough:

git config --global --add credential.helper oauth

Verify the order with:

git config --show-scope --get-all credential.helper

system  osxkeychain
global  oauth

If osxkeychain is missing, add it to ~/.gitconfig before oauth. On Linux, use cache or libsecret as the storage helper.^[1]

HTTPS remotes

Credential helpers only apply to HTTPS. Remotes cloned over SSH (git@github.com:…) keep using SSH keys. To switch an existing repository:

git remote set-url origin https://github.com/OWNER/REPO.git

Or rewrite all GitHub SSH URLs to HTTPS globally:

git config --global url."https://github.com/".insteadOf git@github.com:

git-credential-oauth README ↩

Secure Enclave SSH Keys on macOS 26

2026-06-12T00:00:00+00:00

Secretive was long the standard tool for generating and storing SSH keys in the Secure Enclave, keeping the private key isolated on hardware and requiring Touch ID for each signing operation. In macOS 26, this capability is built directly into the operating system through sc_auth and /usr/lib/ssh-keychain.dylib.

For detailed setup instructions, see Native Secure Enclave SSH Keys (the macOS guide) or this quick gist. Apple also details the underlying CryptoTokenKit APIs in Protecting keys with the Secure Enclave.

Enable Touch ID for sudo on macOS

2026-06-07T00:00:00+00:00

Starting in macOS Sonoma, Apple introduced /etc/pam.d/sudo_local, allowing Touch ID configuration for sudo to persist across operating system updates.^[1]

To enable it, generate the configuration file from Apple’s template:

sed "s/^#auth/auth/" /etc/pam.d/sudo_local.template | sudo tee /etc/pam.d/sudo_local

This creates /etc/pam.d/sudo_local with pam_tid.so enabled:

# sudo_local: local config file which survives system update and is included for sudo
# uncomment following line to enable Touch ID for sudo
auth       sufficient     pam_tid.so

Open a new terminal session to test it. Running sudo will now prompt for fingerprint authentication before falling back to a password prompt.

Apple Support HT213893, Stack Exchange ↩