Home / Alt manpages / git-credential-cache(1)

  • git-credential-cache(1)
  • User command
  • linux

Stop Retyping Git Passwords with git-credential-cache

You push to an HTTPS remote five times in ten minutes and Git asks for your password five times. This guide sets up git-credential-cache, so Git remembers your credentials in a short-lived per-user daemon and stops asking. The cache lives in process memory, not a credentials file, and vanishes when its timeout expires or the daemon stops. Allow about five minutes for setup and a quick check.

The route

Jump straight to the step you need, or tick off Done means at the end.

This guide targets the git-credential-cache helper from Git 2.43.0, installed here by the Debian git-man package version 1:2.43.0-1ubuntu7.3. The documented defaults used below are:

  • Timeout: 900 seconds.
  • Socket: a Unix socket under $XDG_CACHE_HOME/git/credential/socket.
  • Legacy location: the home-directory location is selected when ~/.git-credential-cache/ already exists.

1. Check the installed helper

Run this as your normal user. No elevated privileges are needed, and sudo would create a separate root-owned cache that your ordinary Git commands cannot use.

$ git --version
git version 2.43.0
$ command -v git-credential-cache
/usr/lib/git-core/git-credential-cache

The helper path can differ between distributions. What matters is that Git is installed and the helper is available to the same user who will run the repository commands.

2. Enable the default temporary cache

Configure the helper in your Git configuration:

$ git config --global credential.helper cache

This changes your user-level Git configuration. It does not store a credential straight away. The cache daemon starts when a Git operation needs to store or retrieve one.

Confirm the effective setting before you rely on it:

$ git config --global --get-all credential.helper
cache

Checkpoint

You should see just cache. If the output is empty, you configured a different scope or a different Git configuration file. If another helper is listed too, Git may consult several helpers in order, so run git config --show-origin --get-all credential.helper before assuming this cache is the only credential store.

3. Use it with an HTTPS remote

Run a normal Git operation against your HTTPS remote. The first operation that needs authentication prompts for the username and password or token, and Git then passes the credential to the cache helper.

$ git push https://git.example.invalid/team/project.git
Username for 'https://git.example.invalid': your-user
Password for 'https://[email protected]': [type the credential]

Use your real host and repository in practice. The example host is deliberately invalid, so do not paste it into a production command. On a later operation in the same credential scope, the helper can answer from memory and Git should not prompt again while the cache entry is alive.

Warning

Do not paste a token into a command line or a remote URL. Shell history, process listings and logs can expose it. Let Git prompt, or use the host's supported secure authentication helper when you need longer-lived access.

4. Set a deliberate timeout

The default cache lifetime is 900 seconds, or 15 minutes. If a short maintenance session needs an hour, set the timeout as an option on the helper value:

$ git config --global credential.helper 'cache --timeout=3600'
$ git config --global --get-all credential.helper
cache --timeout=3600

The number is seconds. This is still temporary storage, not a promise that the credential survives a restart. The daemon can die sooner, including when the system restarts, and its credentials are then forgotten.

Tip

Setting credential.helper to cache and later to cache --timeout=3600 at the same scope replaces the earlier value, which is normally what you want. If several values exist, use --get-all and review them rather than guessing which one runs first.

5. Check the socket boundary

The daemon talks through a Unix domain socket. The default is:

$ printf '%s\n' "${XDG_CACHE_HOME:-$HOME/.cache}/git/credential/socket"
/home/your-user/.cache/git/credential/socket

The helper's documented fallback is ~/.git-credential-cache/socket when the directory ~/.git-credential-cache/ exists. A custom socket must be an absolute path. If your home directory is on a network-mounted filesystem, pick a suitable local path and configure it explicitly:

$ git config --global credential.helper 'cache --socket=/run/user/1000/git-credential-cache/socket --timeout=900'

Replace 1000 with your user ID, which id -u prints. The parent directory must exist and be writable by your user. This option changes where the client contacts the daemon. It does not make the cache persistent.

6. Clear cached credentials when finished

When the work is done, stop the daemon and forget the cached credentials:

$ git credential-cache exit

It normally prints nothing, and it is safe to run when no daemon is running. Afterwards, the next operation that needs authentication should prompt again.

Recovery

If you cached the wrong account or used a credential with the wrong remote, run git credential-cache exit. Git will prompt afresh next time.

To remove the configuration as well, run:

$ git config --global --unset-all credential.helper

That changes your global Git configuration, and it may return a non-zero status if no matching entry exists. Removing the configuration does not by itself make an already-running daemon forget its entries, so run git credential-cache exit first.

7. Know when this helper is the wrong fit

This helper suits a short interactive session, and it is deliberately not persistent. It is also only as private as the local user's Unix permissions and machine access. Anyone who can run code as your user may be able to use the cache through its socket.

For a credential that must survive a reboot, choose a persistent helper with a suitable security model, such as an operating-system keyring or an OAuth helper supported by your Git host.

Warning

Do not swap the in-memory cache for git-credential-store casually. That helper writes credentials to disk in a form that may not meet your security requirements.

Done means

  • Setting confirmed. git config --global --get-all credential.helper shows the intended cache setting.
  • Reuse works. An HTTPS Git operation reuses a credential within the configured timeout.
  • Expiry understood. You know the cache expires after the timeout or a daemon failure, including a restart.
  • Clean exit. git credential-cache exit clears the session when you finish.
  • No leaks. No credential sits in a remote URL, shell history or pasted command.