Git Credential Manager
Cross-platform Git credential storage for GitHub, Azure, and more
Install with Homebrew
brew install --cask git-credential-managerQuick Take: Git Credential Manager
Install GCM if you push over HTTPS and your hosts enforce 2FA. After one browser login, token refresh and Keychain storage remove the daily PAT grind. SSH keys still make sense when you want explicit key files or headless boxes, but for day-to-day Mac work against GitHub, GitLab, Bitbucket, or Azure DevOps with MFA, GCM is the practical default. Rate it 4.5/5 for HTTPS Mac workflows that need OAuth and SSO without babysitting tokens. Pair it with SSH only where you already manage keys for servers; do not feel forced to pick a single method for every remote.
Best For
- •Developers with 2FA-enabled Git accounts
- •Teams standardizing on HTTPS workflows
- •Enterprise environments with SSO requirements
What is Git Credential Manager?
As of August 2026 Git Credential Manager 2.9.1 is the current release. Git Credential Manager (GCM) is a cross-platform credential helper maintained by GitHub (Microsoft) for HTTPS Git authentication. Basic helpers that ship with Git store a username and password; GCM adds multi-factor authentication, OAuth, and native keychain storage so modern Git hosts stay usable without pasting Personal Access Tokens by hand. Mac developers who prefer HTTPS over SSH authenticate once through a browser OAuth handshake. After that, credentials live in the macOS Keychain, encrypted at rest, and GCM refreshes them when tokens expire. GCM covers GitHub (and GitHub Enterprise), GitLab, Bitbucket, and Azure DevOps, picking the provider from the remote URL so you can hit several hosts in one terminal session without fighting config conflicts. The tool started as separate platform builds and later became one .NET codebase that behaves the same on macOS, Windows, or Linux. Teams that require two-factor authentication or Single Sign-On (SSO) for HTTPS workflows usually need GCM because older credential stores cannot run the OAuth device flow. It hooks into your terminal, opens the default browser for the first login, then stays quiet for later pushes and pulls. The project is open-source at github.com/git-ecosystem/git-credential-manager and ships regular releases when providers change auth methods or add features. Homebrew remains the usual Mac install path (brew install --cask git-credential-manager), after which git config --global credential.helper manager wires Git to call GCM on every HTTPS remote. Legacy search results still mention "Git Credential Manager for Windows"; that Windows-only branding is retired, and the current cross-platform GCM is the supported line.
Closer look: secure HTTPS Git auth on Mac
How Git Credential Manager fits modern Git hosts that expect OAuth and MFA instead of long-lived passwords.
History & Background
Git Credential Manager grew out of separate tools: Git Credential Manager for Windows, plus Mac and Linux helpers. In 2020 those lines merged into one cross-platform .NET Core project, now just called Git Credential Manager. One codebase meant shared features and fewer platform-only surprises. Moving under git-ecosystem on GitHub marked it as shared Git infrastructure rather than a Windows-only addon.
How It Works
GCM is a Git credential helper: Git calls it when a remote needs credentials. Git passes protocol and host; GCM checks the macOS Keychain for a still-valid token. If nothing is there or the token expired, GCM opens a browser OAuth flow. After login it stores the token and returns it to Git. The bundled .NET runtime implements OAuth details such as PKCE.
Ecosystem & Integrations
GCM sits next to tools like GitHub CLI (gh), which can share credentials through the same helper. In VS Code, built-in Git operations often rely on the same stored tokens. CI systems usually use deploy keys or PATs in environment variables instead, so GCM stays the interactive workstation choice. Credential namespaces let you separate stores by host or by account on the same host. Microsoft Learn still documents GCM for Azure Repos HTTPS setups, which is another reason teams standardize on it when Azure DevOps and GitHub show up in the same week.
Future Development
Recent work targets GitHub Enterprise and Azure DevOps users with messy SSO setups. Maintainers keep adding auth methods as hosts tighten security. Windows Hello and biometric paths improved on Windows; macOS Touch ID ideas are under discussion. Releases aim to keep older configs working while new options land.
Key Features
Native macOS Keychain Integration
GCM stores Git credentials in the macOS Keychain using Apple's credential storage. Tokens sit encrypted at rest under your system's security settings, and you can inspect or delete them in Keychain Access. Credentials survive terminal sessions and reboots, so you are not asked to log in again every morning. After a successful GitHub login you typically see Keychain entries labeled like `git:https://github.com`, which is useful when you need to revoke access on a shared Mac.
Multi-Factor Authentication Support
Basic credential helpers stall on 2FA-protected accounts. GCM runs MFA through an OAuth device flow instead: a push opens your browser, you finish any MFA challenge there, and the OAuth token is saved. You do not need to mint and paste Personal Access Tokens for routine Git work.
Automatic Token Refresh
OAuth tokens expire, and refreshing them by hand is tedious. GCM watches expiry and renews credentials before they go stale, so Git operations do not fail on dead tokens. The refresh happens in the background while you keep working.
Multi-Provider Detection
GCM reads the remote URL and chooses the right host flow. A push to GitHub, a pull from GitLab, or a clone from Azure DevOps each gets the matching auth path. You can stay in one terminal session across providers without rewriting credential config between projects.
Cross-Platform Consistency
Built on .NET, GCM keeps the same behavior on macOS, Windows, and Linux. Teams that share dotfiles, scripts, or CI settings can point credential.helper at GCM everywhere. Developers who move between operating systems keep the same auth habits.
Enterprise SSO Support
Organizations on SAML or OIDC Single Sign-On with GitHub Enterprise or Azure DevOps can complete SSO challenges inside the browser auth flow. That makes GCM usable in corporate setups that enforce identity governance. If auto-detection misses a custom enterprise hostname, set the provider explicitly (for example `git config --global credential.github.mycompany.com.provider github`).
Who Should Use Git Credential Manager?
1The Security-Conscious Developer
A developer at a company that mandates 2FA on GitHub pushes code several times a day. Without GCM they would mint a Personal Access Token, stash it somewhere risky, and paste it whenever Git asks. With GCM they authenticate once in the browser, finish the 2FA challenge, and leave auth alone afterward. The OAuth token stays in the Keychain and refreshes on its own.
2The Multi-Platform Contractor
A freelance developer juggles clients on GitHub, GitLab, and Azure DevOps. Instead of juggling SSH keys or remembering which PAT belongs where, they install GCM once. On clone or push, GCM detects the host and runs the right login, so switching projects costs less mental overhead.
3The Enterprise Team Lead
An engineering manager onboards people onto GitHub Enterprise with SAML SSO. New hires used to stall on auth setup. Standardizing on GCM shortens that path: install via Homebrew, run the first Git command, and the SSO browser flow starts. No manual token docs, fewer onboarding tickets.
Install Git Credential Manager on Mac
Install Git Credential Manager on macOS with Homebrew. It plugs into your existing Git install and needs only a short credential.helper config before the first HTTPS push.
Install Homebrew (if not present)
Open Terminal and run: /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" to install the Homebrew package manager.
Install Git Credential Manager
Run the Homebrew Cask command to install GCM: brew install --cask git-credential-manager. Homebrew downloads the current stable release (2.9.1 as of August 2026) and places the helper on your system.
Configure Git to Use GCM
Tell Git to use GCM as your credential helper: git config --global credential.helper manager. This sets GCM as the default for all repositories.
Verify Installation
Run git credential-manager --version to confirm the installation succeeded. You should see the version number printed to your terminal.
Pro Tips
- • Your first git push or pull to a remote opens the browser authentication flow. That is expected.
- • Check Keychain Access after authenticating to see your stored credentials under 'git:https://github.com' or similar entries.
- • For stubborn auth failures, rerun the failing Git command with
GCM_TRACE=1to print the credential flow.
Configuration Tips
Set Default Browser for Auth
If GCM opens the wrong browser for authentication, you can specify your preferred browser. Run git config --global credential.browser /Applications/Firefox.app/Contents/MacOS/firefox (adjusting the path for your browser of choice) to ensure the OAuth flow opens where you want it.
Enable Credential Caching
For temporary credentials (for example in CI), set GCM's cache timeout: git config --global credential.cacheOptions "--timeout 7200" caches credentials for two hours and cuts down on prompts during heavy local work.
Configure for Multiple GitHub Accounts
If you use separate GitHub accounts for work and personal projects, configure GCM to prompt for account selection: git config --global credential.github.com.useHttpPath true. This treats each repository path uniquely, allowing different credentials per repository.
Alternatives to Git Credential Manager
GCM is strong at HTTPS auth with MFA, but other options fit different security habits and workflows.
git-credential-osxkeychain
SSH Keys
GitHub CLI (gh)
Pricing
Git Credential Manager is free and open-source under the MIT License. There are no paid tiers, subscriptions, or enterprise SKUs. GitHub (Microsoft) and community contributors maintain it. Enterprise SSO support and multi-host authentication ship in the same free binary. Source lives at github.com/git-ecosystem/git-credential-manager.
Pros
- ✓Handles 2FA and OAuth flows that break basic credential helpers.
- ✓Stores credentials in the native macOS Keychain with encryption at rest.
- ✓Works with GitHub, GitLab, Bitbucket, and Azure DevOps without extra plugins.
- ✓Refreshes expired tokens without asking you to paste a new PAT.
- ✓Same helper config works across macOS, Windows, and Linux for team standards.
Cons
- ✗Bundles a .NET runtime, so the install is larger than a tiny native helper.
- ✗Browser-based login is awkward in headless or SSH-only environments.
- ✗Some people still prefer SSH keys for explicit key management and audit trails.
Community & Support
Git Credential Manager lives under the git-ecosystem organization on GitHub, with GitHub/Microsoft staff and outside contributors. Bug reports, feature requests, and discussions happen on that repo. Docs include troubleshooting for common auth failures. Because GCM is the recommended helper for GitHub and Azure DevOps, it gets steady security patches and compatibility fixes. Stack Overflow carries a GCM tag, and most Git-focused communities recognize the tool. The project sits above 500 GitHub stars and ships releases roughly every 4-6 weeks when hosts change auth rules or expose new login options. Install docs live in the repo under docs/install.md, and Microsoft's Azure Repos guidance still points Mac users at the Homebrew cask for GCM when talking to Azure DevOps remotes.
Frequently Asked Questions about Git Credential Manager
About the Author
Expert Tips for Git Credential Manager
Cross-platform GCM fully supersedes the retired Windows-only Git Credential Manager branding still found in old search results.
Mac developers typically install GCM once via Homebrew and point credential.helper at it to stop HTTPS token prompts across GitHub and Azure DevOps.
Related Technologies & Concepts
Related Topics
Git Authentication & Security
Tools and practices for securely authenticating with Git repositories and managing credentials.
Developer Security Tools
Software that protects developer workflows, stored credentials, and sensitive local data.
Sources & References
Fact-CheckedLast verified: Aug 9, 2026
Key Verified Facts
- GCM 2.9.1 is the latest release on git-ecosystem/git-credential-manager.[cite-1]
- GCM is a free open-source cross-platform Git credential helper.[cite-2]
- Microsoft documents Homebrew installation of GCM on macOS for Azure Repos.[cite-3]
- 1GCM Releases
Accessed Aug 9, 2026
- 2git-credential-manager repository
Accessed Aug 9, 2026
- 3Use Git Credential Manager with Azure Repos
Accessed Aug 9, 2026
- 4Legacy GCM for Windows notice
Accessed Aug 9, 2026
- 5GitHub Blog on GCM Core
Accessed Aug 9, 2026
- 6GCM install docs
Accessed Aug 9, 2026
Research queries: Git Credential Manager Mac 2026 installation OAuth 2FA Keychain