Sourcetree HTTPS Credentials: OS Keychain vs External Git Credential Helper

The decision

Teams using Sourcetree with HTTPS remotes need a credential storage strategy that stops repeated password prompts on macOS and Windows, keeps secrets machine-bound, and works consistently between the Sourcetree GUI and the Git CLI. Sourcetree bundles its own Git, so system Git settings do not automatically apply unless Sourcetree is pointed to system Git.

Constraints: mixed macOS and Windows desktops, HTTPS remotes with personal access tokens, no manual re-entry per fetch, and no central secret store. The choice is between relying on the OS vault that Sourcetree’s bundled Git already uses, or forcing an explicit external credential helper.

Options compared

Trade-offs for a team

Built-in OS storage minimizes friction for new hires and respects platform security models. Credentials are stored in the user’s macOS Keychain or Windows Credential Manager and unlocked with the login session. The downside is machine lock-in and no team-wide policy. macOS Keychain items are user-specific; shared machines will prompt repeatedly and migration requires manual export.

An external helper adds operational overhead but enables shared configuration via dotfiles or onboarding scripts. It allows use of cache with timeout for service accounts and makes behavior explicit. The cost is maintenance: Sourcetree bundles its own Git, so helper changes in system Git are invisible to Sourcetree unless you switch Sourcetree to use system Git. Credential helper changes can be reset by Sourcetree updates on Windows.

Concrete implementation in Sourcetree

Check current setup

Open Sourcetree > Tools > Options > Git. Note the Git version reported as bundled with Sourcetree. The Credential helper field shows the current value. None means use OS default.

To inspect what Git actually sees, run in a terminal on the same machine:

git config --list --show-origin | grep credential

Run as the user who uses Sourcetree. This shows config from system, user and repo scopes. Expect no output if relying on OS default.

Choose and apply a helper

For low friction and OS-native storage, leave Credential helper as None. Sourcetree’s bundled Git will use macOS Keychain or Windows Credential Manager.

For explicit control, set a helper:

• Windows: Tools > Options > Git > Credential helper = manager-core
• macOS: Tools > Options > Git > Credential helper = osxkeychain

If you want a time-limited cache instead of persistent storage, set Credential helper to cache and configure timeout via Git config. Run in terminal where Sourcetree’s Git is used:

git config --global credential.helper "cache --timeout=3600"

Required permissions: user write access to ~/.gitconfig. Risk: setting a helper that is not installed will cause authentication failures and prompts on every operation.

Validation without assuming success

Remove existing stored credential from the OS vault to force a fresh prompt. On macOS use Keychain Access to delete the internet password entry for the remote host. On Windows use Credential Manager to remove the Generic Credential for git:https://.

Then in Sourcetree perform Fetch on an HTTPS remote. Expected behavior: a prompt appears for username and token, and after entry the next Fetch uses the cached credential per the chosen helper.

Repeat the same Fetch and Push from system Git CLI on the same machine to confirm both GUI and CLI use the same helper when Sourcetree is configured to use system Git. If Sourcetree uses bundled Git, CLI behavior may differ.

Document the chosen helper in team onboarding checklist and note that Sourcetree updates may reset the Credential helper field on Windows.

Limitations

Sourcetree bundles its own Git; system Git credential helper settings do not automatically apply unless Sourcetree is pointed to system Git. Helper names are OS-specific and not portable. Tokens are still stored in the OS vault, not encrypted by Sourcetree itself. No central audit of stored credentials is possible with OS defaults.