git-credential-oauth: OAuth for Git

git-credential-oauth is a Git credential helper that authenticates to GitHub, GitLab, Bitbucket, and other forges using OAuth. On your first push or pull, it opens a browser tab to authenticate, then a storage helper caches the token for subsequent commands, so you don’t need to create, rotate, or paste personal access tokens.

Installation

brew install git-credential-oauth

Configuration

Git supports chaining credential helpers, evaluating them in order until one provides valid credentials. In this setup, git-credential-oauth acquires OAuth tokens, while a storage helper like osxkeychain caches them locally.

The order matters: the storage helper must come first so Git checks stored credentials before starting a new OAuth flow. On macOS, Homebrew’s Git already configures osxkeychain in its system config (/opt/homebrew/etc/gitconfig), and Git reads the system config before ~/.gitconfig. So adding oauth to your global config is enough:

git config --global --add credential.helper oauth

Verify the order with:

git config --show-scope --get-all credential.helper

system  osxkeychain
global  oauth

If osxkeychain is missing, add it to ~/.gitconfig before oauth. On Linux, use cache or libsecret as the storage helper.^[1]

HTTPS remotes

Credential helpers only apply to HTTPS. Remotes cloned over SSH ([email protected]:…) keep using SSH keys. To switch an existing repository:

git remote set-url origin https://github.com/OWNER/REPO.git

Or rewrite all GitHub SSH URLs to HTTPS globally:

git config --global url."https://github.com/".insteadOf [email protected]:

git-credential-oauth README ↩