Is Git Credential Manager better than SSH keys?

Neither wins for every setup. GCM fits HTTPS URLs, 2FA-protected accounts, and browser login. SSH keys fit headless servers, automation, and people who want explicit key files. Many developers keep both and pick per machine or repo.

Does Git Credential Manager work with GitHub 2FA?

Yes. That is one of GCM's main jobs. On a 2FA-protected GitHub push, GCM opens the browser for OAuth, you finish the 2FA step, and the token is stored. You stay signed in until the token expires or you revoke it.

How do I remove credentials stored by Git Credential Manager?

Open Keychain Access on your Mac and search for entries starting with 'git:' followed by your repository host (for example 'git:https://github.com'). Select the entry and delete it. You can also run `git credential-manager erase` and supply the protocol and host when prompted. Clearing the Keychain entry forces the next Git operation to open a fresh browser login.

Can I use Git Credential Manager with multiple GitHub accounts?

Yes. Turn on HTTP path matching with `git config --global credential.github.com.useHttpPath true`. GCM then treats each repository path as unique, so work and personal GitHub accounts can keep separate tokens based on the full remote URL rather than sharing one host-wide credential.

Does Git Credential Manager support GitLab and Bitbucket?

Yes. GCM supports GitLab, Bitbucket, and Bitbucket Server alongside GitHub and Azure DevOps. On HTTPS clone or push, it detects the host from the remote URL and starts the matching OAuth flow. Tokens land in the macOS Keychain, and refresh works across those hosts.

How do I uninstall Git Credential Manager on macOS?

Unset the helper with `git config --global --unset credential.helper`, then uninstall the cask: `brew uninstall --cask git-credential-manager`. Open Keychain Access, search for entries starting with 'git:', and delete what you no longer need. After that, Git falls back to its default prompting behavior.

Can Git Credential Manager work alongside GitHub CLI (gh)?

Yes. GitHub CLI covers GitHub-specific tasks such as pull requests and issues, while GCM stores credentials for HTTPS Git across hosts. When both are installed they can share Keychain entries, so a login in one tool often helps the other.

PublishedJanuary 1, 2026•UpdatedSeptember 4, 2026

Git Credential Manager

Name: Git Credential Manager
Availability: InStock

Cross-platform Git credential storage for GitHub, Azure, and more

Developer ToolsFree

Are you the maker of Git Credential Manager?

Install with Homebrew

brew install --cask git-credential-manager

Quick Take: Git Credential Manager

4.5

Install GCM if you push over HTTPS and your hosts enforce 2FA. After one browser login, token refresh and Keychain storage remove the daily PAT grind. SSH keys still make sense when you want explicit key files or headless boxes, but for day-to-day Mac work against GitHub, GitLab, Bitbucket, or Azure DevOps with MFA, GCM is the practical default. Rate it 4.5/5 for HTTPS Mac workflows that need OAuth and SSO without babysitting tokens. Pair it with SSH only where you already manage keys for servers; do not feel forced to pick a single method for every remote.

Best For

•Developers with 2FA-enabled Git accounts
•Teams standardizing on HTTPS workflows
•Enterprise environments with SSO requirements

What is Git Credential Manager?

As of August 2026 Git Credential Manager 2.9.1 is the current release. Git Credential Manager (GCM) is a cross-platform credential helper maintained by GitHub (Microsoft) for HTTPS Git authentication. Basic helpers that ship with Git store a username and password; GCM adds multi-factor authentication, OAuth, and native keychain storage so modern Git hosts stay usable without pasting Personal Access Tokens by hand. Mac developers who prefer HTTPS over SSH authenticate once through a browser OAuth handshake. After that, credentials live in the macOS Keychain, encrypted at rest, and GCM refreshes them when tokens expire. GCM covers GitHub (and GitHub Enterprise), GitLab, Bitbucket, and Azure DevOps, picking the provider from the remote URL so you can hit several hosts in one terminal session without fighting config conflicts. The tool started as separate platform builds and later became one .NET codebase that behaves the same on macOS, Windows, or Linux. Teams that require two-factor authentication or Single Sign-On (SSO) for HTTPS workflows usually need GCM because older credential stores cannot run the OAuth device flow. It hooks into your terminal, opens the default browser for the first login, then stays quiet for later pushes and pulls. The project is open-source at github.com/git-ecosystem/git-credential-manager and ships regular releases when providers change auth methods or add features. Homebrew remains the usual Mac install path (brew install --cask git-credential-manager), after which git config --global credential.helper manager wires Git to call GCM on every HTTPS remote. Legacy search results still mention "Git Credential Manager for Windows"; that Windows-only branding is retired, and the current cross-platform GCM is the supported line.

Closer look: secure HTTPS Git auth on Mac

How Git Credential Manager fits modern Git hosts that expect OAuth and MFA instead of long-lived passwords.

History & Background

Git Credential Manager grew out of separate tools: Git Credential Manager for Windows, plus Mac and Linux helpers. In 2020 those lines merged into one cross-platform .NET Core project, now just called Git Credential Manager. One codebase meant shared features and fewer platform-only surprises. Moving under git-ecosystem on GitHub marked it as shared Git infrastructure rather than a Windows-only addon.

How It Works

GCM is a Git credential helper: Git calls it when a remote needs credentials. Git passes protocol and host; GCM checks the macOS Keychain for a still-valid token. If nothing is there or the token expired, GCM opens a browser OAuth flow. After login it stores the token and returns it to Git. The bundled .NET runtime implements OAuth details such as PKCE.

Ecosystem & Integrations

GCM sits next to tools like GitHub CLI (gh), which can share credentials through the same helper. In VS Code, built-in Git operations often rely on the same stored tokens. CI systems usually use deploy keys or PATs in environment variables instead, so GCM stays the interactive workstation choice. Credential namespaces let you separate stores by host or by account on the same host. Microsoft Learn still documents GCM for Azure Repos HTTPS setups, which is another reason teams standardize on it when Azure DevOps and GitHub show up in the same week.

Future Development

Recent work targets GitHub Enterprise and Azure DevOps users with messy SSO setups. Maintainers keep adding auth methods as hosts tighten security. Windows Hello and biometric paths improved on Windows; macOS Touch ID ideas are under discussion. Releases aim to keep older configs working while new options land.

Key Features

Native macOS Keychain Integration

GCM stores Git credentials in the macOS Keychain using Apple's credential storage. Tokens sit encrypted at rest under your system's security settings, and you can inspect or delete them in Keychain Access. Credentials survive terminal sessions and reboots, so you are not asked to log in again every morning. After a successful GitHub login you typically see Keychain entries labeled like `git:https://github.com`, which is useful when you need to revoke access on a shared Mac.

Multi-Factor Authentication Support

Basic credential helpers stall on 2FA-protected accounts. GCM runs MFA through an OAuth device flow instead: a push opens your browser, you finish any MFA challenge there, and the OAuth token is saved. You do not need to mint and paste Personal Access Tokens for routine Git work.

Automatic Token Refresh

OAuth tokens expire, and refreshing them by hand is tedious. GCM watches expiry and renews credentials before they go stale, so Git operations do not fail on dead tokens. The refresh happens in the background while you keep working.

Multi-Provider Detection

GCM reads the remote URL and chooses the right host flow. A push to GitHub, a pull from GitLab, or a clone from Azure DevOps each gets the matching auth path. You can stay in one terminal session across providers without rewriting credential config between projects.

Cross-Platform Consistency

Built on .NET, GCM keeps the same behavior on macOS, Windows, and Linux. Teams that share dotfiles, scripts, or CI settings can point credential.helper at GCM everywhere. Developers who move between operating systems keep the same auth habits.

Enterprise SSO Support

Organizations on SAML or OIDC Single Sign-On with GitHub Enterprise or Azure DevOps can complete SSO challenges inside the browser auth flow. That makes GCM usable in corporate setups that enforce identity governance. If auto-detection misses a custom enterprise hostname, set the provider explicitly (for example `git config --global credential.github.mycompany.com.provider github`).

Who Should Use Git Credential Manager?

1The Security-Conscious Developer

A developer at a company that mandates 2FA on GitHub pushes code several times a day. Without GCM they would mint a Personal Access Token, stash it somewhere risky, and paste it whenever Git asks. With GCM they authenticate once in the browser, finish the 2FA challenge, and leave auth alone afterward. The OAuth token stays in the Keychain and refreshes on its own.

2The Multi-Platform Contractor

A freelance developer juggles clients on GitHub, GitLab, and Azure DevOps. Instead of juggling SSH keys or remembering which PAT belongs where, they install GCM once. On clone or push, GCM detects the host and runs the right login, so switching projects costs less mental overhead.

3The Enterprise Team Lead

An engineering manager onboards people onto GitHub Enterprise with SAML SSO. New hires used to stall on auth setup. Standardizing on GCM shortens that path: install via Homebrew, run the first Git command, and the SSO browser flow starts. No manual token docs, fewer onboarding tickets.

Install Git Credential Manager on Mac

Install Git Credential Manager on macOS with Homebrew. It plugs into your existing Git install and needs only a short credential.helper config before the first HTTPS push.

Install Homebrew (if not present)

Open Terminal and run: /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" to install the Homebrew package manager.

Install Git Credential Manager

Run the Homebrew Cask command to install GCM: brew install --cask git-credential-manager. Homebrew downloads the current stable release (2.9.1 as of August 2026) and places the helper on your system.

Configure Git to Use GCM

Tell Git to use GCM as your credential helper: git config --global credential.helper manager. This sets GCM as the default for all repositories.

Verify Installation

Run git credential-manager --version to confirm the installation succeeded. You should see the version number printed to your terminal.

Pro Tips

• Your first git push or pull to a remote opens the browser authentication flow. That is expected.
• Check Keychain Access after authenticating to see your stored credentials under 'git:https://github.com' or similar entries.
• For stubborn auth failures, rerun the failing Git command with GCM_TRACE=1 to print the credential flow.

Configuration Tips

Set Default Browser for Auth

If GCM opens the wrong browser for authentication, you can specify your preferred browser. Run git config --global credential.browser /Applications/Firefox.app/Contents/MacOS/firefox (adjusting the path for your browser of choice) to ensure the OAuth flow opens where you want it.

Enable Credential Caching

For temporary credentials (for example in CI), set GCM's cache timeout: git config --global credential.cacheOptions "--timeout 7200" caches credentials for two hours and cuts down on prompts during heavy local work.

Configure for Multiple GitHub Accounts

If you use separate GitHub accounts for work and personal projects, configure GCM to prompt for account selection: git config --global credential.github.com.useHttpPath true. This treats each repository path uniquely, allowing different credentials per repository.

Alternatives to Git Credential Manager

GCM is strong at HTTPS auth with MFA, but other options fit different security habits and workflows.

git-credential-osxkeychain

SSH Keys

GitHub CLI (gh)

Pricing

Free & Open Source

Git Credential Manager is free and open-source under the MIT License. There are no paid tiers, subscriptions, or enterprise SKUs. GitHub (Microsoft) and community contributors maintain it. Enterprise SSO support and multi-host authentication ship in the same free binary. Source lives at github.com/git-ecosystem/git-credential-manager.

Pros

✓Handles 2FA and OAuth flows that break basic credential helpers.
✓Stores credentials in the native macOS Keychain with encryption at rest.
✓Works with GitHub, GitLab, Bitbucket, and Azure DevOps without extra plugins.
✓Refreshes expired tokens without asking you to paste a new PAT.
✓Same helper config works across macOS, Windows, and Linux for team standards.

Cons

✗Bundles a .NET runtime, so the install is larger than a tiny native helper.
✗Browser-based login is awkward in headless or SSH-only environments.
✗Some people still prefer SSH keys for explicit key management and audit trails.

Community & Support

Git Credential Manager lives under the git-ecosystem organization on GitHub, with GitHub/Microsoft staff and outside contributors. Bug reports, feature requests, and discussions happen on that repo. Docs include troubleshooting for common auth failures. Because GCM is the recommended helper for GitHub and Azure DevOps, it gets steady security patches and compatibility fixes. Stack Overflow carries a GCM tag, and most Git-focused communities recognize the tool. The project sits above 500 GitHub stars and ships releases roughly every 4-6 weeks when hosts change auth rules or expose new login options. Install docs live in the repo under docs/install.md, and Microsoft's Azure Repos guidance still points Mac users at the Homebrew cask for GCM when talking to Azure DevOps remotes.

Frequently Asked Questions about Git Credential Manager

Git Credential Manager stores and renews Git credentials for HTTPS remotes. It runs OAuth login, supports multi-factor authentication, and writes tokens into the OS credential store (macOS Keychain on Mac). You sign in once in a browser; later Git operations reuse the stored token.

About the Author

Alex Chen

Senior Developer Tools Specialist

Code Editors & IDEsTerminal EmulatorsVersion Control Tools

12+ years in software development · Former senior engineer at tech startups

Expert Tips for Git Credential Manager

Cross-platform GCM fully supersedes the retired Windows-only Git Credential Manager branding still found in old search results.

Official DocsHigh Confidence

Mac developers typically install GCM once via Homebrew and point credential.helper at it to stop HTTPS token prompts across GitHub and Azure DevOps.

Hands-on TestingHigh Confidence

Related Technologies & Concepts

macOS KeychainOAuth 2.0GitHubPersonal Access TokenHomebrew

Sources & References

Fact-Checked

Last verified: Aug 9, 2026

Key Verified Facts

GCM 2.9.1 is the latest release on git-ecosystem/git-credential-manager.[cite-1]
GCM is a free open-source cross-platform Git credential helper.[cite-2]
Microsoft documents Homebrew installation of GCM on macOS for Azure Repos.[cite-3]