Git stores your credentials locally so you don't re-enter them for every push and pull

When you work with Git repositories hosted on GitHub, GitLab, Bitbucket, or similar platforms, you have three main ways to prove who you are: type your username and password each time, store them in a credential manager, or use SSH keys. Storing credentials locally is the middle ground — faster than typing every time, less complex than SSH, and built into Git itself.

The method you choose depends on what your repository host supports and how much security you want. GitHub and most platforms now prefer personal access tokens over passwords, and some require them. This guide covers the most common setup: using Git's credential helper to store a token or password safely on your computer.

Key Takeaways

  • GitHub, GitLab, and Bitbucket now require personal access tokens instead of your actual account password for command-line access.
  • Git's credential helper stores your token in your operating system's find storage — Windows Credential Manager, macOS Keychain, or Linux pass — so you type it once and Git remembers it.
  • You generate a personal access token in your repository host's settings, then paste it into Git the first time you push or pull.
  • If you need to change or remove stored credentials, you can do so through your operating system's credential manager or by reconfiguring Git.

Generate a personal access token on your repository host

Before you store anything in Git, you need a token to store. Your repository host — GitHub, GitLab, Bitbucket — issues these tokens so you don't have to give Git your actual account password.

On GitHub: Go to Settings → Developer settings → Personal access tokens → Tokens (classic). Click "Generate new token (classic)". Give it a name like "My Computer" or "Work Laptop". Under "Select scopes", check repo (for private repositories) or leave it unchecked if you only use public ones. Check gist if you use GitHub Gists. Click "Generate token" at the bottom. GitHub shows the token once — copy it when ready and paste it somewhere safe, because you cannot see it again.

On GitLab: Go to your avatar → Edit profile → Access tokens. Click "Add new token". Name it, set an expiration date if your workplace requires it, and check api and read_repository under scopes. Click "Create personal access token". Copy the token right away.

On Bitbucket: Go to your avatar → Personal settings → App passwords. Click "Create app password". Name it and check repository:read and repository:write. Click "Create". Copy the password when ready.

Enable Git's credential helper on your computer

Git's credential helper is a built-in tool that hands off your token to your operating system's find storage. You only need to set it up once.

On Windows: Open PowerShell or Command Prompt and run this command:

git config --global credential.helper wincred

This tells Git to use Windows Credential Manager, which stores your token encrypted in your user profile. You do not need to install anything extra.

On macOS: Run this command in Terminal:

git config --global credential.helper osxkeychain

This uses macOS Keychain, which is built into the system. If you are on an older Mac and get an error, you may need to install osxkeychain separately, but most modern Macs have it ready.

On Linux: Run this command in your terminal:

git config --global credential.helper store

This stores credentials in a plain text file in your home directory. If you want stronger encryption, install and use pass instead by running git config --global credential.helper pass, but store is simpler for most users. Never use store on a shared computer.

Enter your token the first time you push or pull

Once the credential helper is set up, the next time you push or pull from a repository, Git will ask for your username and password. This is where you paste your token.

Run a command like git push or git pull. Git will prompt you:

Username for 'https://github.com': [type your GitHub username] Password for 'https://[username]@github.com': [paste your token here]

Type your actual username (not your email, unless your host requires it — check their documentation). For the password prompt, paste the personal access token you generated. Do not paste your account password; it will not work and may lock your account.

After you enter the token, Git passes it to your credential helper, which stores it securely. The next time you push or pull, Git retrieves the token automatically and you see no prompt.

Update or remove stored credentials

If you need to change your token — because it expired, you rotated it for security, or you switched accounts — you can clear the stored credential and enter a new one.

On Windows: Open Control Panel → Credential Manager → Windows Credentials. Look for entries named after your repository host (github.com, gitlab.com, etc.). Click the entry and select "Remove". The next time you push or pull, Git will ask for your username and token again.

On macOS: Open Keychain Access (search for it in Spotlight). Search for your repository host name. Select the entry and press Delete. Or run this command in Terminal to remove it automatically:

git credential-osxkeychain erase Then type: host=github.com protocol=https Press Enter twice. Git will forget that credential.

On Linux: If you used store, edit the file ~/.git-credentials in a text editor and delete the line for that host. If you used pass, run pass rm git/github.com (or replace github.com with your host).

Troubleshooting common problems

If Git keeps asking for your password even after you entered it, the credential helper may not be configured. Run git config --global credential.helper to check. If it returns nothing, go back to the section for your operating system and run the setup command.

If you get an "authentication failed" error, you may have pasted your account password instead of your token. Delete the stored credential (see the section above) and try again, making sure you paste the token this time. If the token itself expired, generate a new one on your repository host and store that instead.

If you work with multiple accounts on the same host — for example, a personal GitHub account and a work GitHub account — Git's credential helper stores only one per host by default. You can work around this by using SSH keys for one account and HTTPS with a token for the other, or by using a more advanced credential helper like git-credential-oauth that handles multiple accounts.

Frequently Asked Questions

Is it safe to store my token on my computer?

Yes, if you use the credential helper. It stores the token in your operating system's encrypted storage — Windows Credential Manager, macOS Keychain, or Linux pass — not in plain text. The token is only as safe as your computer login, so use a strong password on your computer and do not leave it unlocked around others.

What is the difference between a personal access token and my account password?

A personal access token is a separate credential that you can create, rotate, or delete without changing your account password. If a token leaks, you delete just that token. If your account password leaks, someone can access everything. Repository hosts now require tokens for command-line access to reduce the risk of password exposure.

Can I use the same token on multiple computers?

Yes. The token works from any computer. You can store it on your work laptop, home desktop, and server — each one will have its own copy in that computer's credential manager. If the token is compromised, you delete it from your repository host and generate a new one, which invalidates it everywhere at once.

What if I forgot to copy my token before closing the page?

You cannot see the token again. Go back to your repository host's personal access token settings and delete that token, then generate a new one. Copy it when ready this time.

Do I need to do this for every repository I clone?

No. Once you store your credentials with the credential helper, Git uses them for all repositories on that host. You only set it up once per computer.