Git credential cache and store backend interoperability

Question

Goal: determine whether Git shares authentication data between the in-memory cache helper and the plaintext store helper when both are listed under credential.helper.

Git tries each configured helper in order, but backends do not synchronize automatically. Behavior may vary by Git build and platform. The cache helper keeps secrets in a per-user daemon until its timeout, while store appends them to ~/.git-credentials without expiration. It is unclear whether a credential supplied by cache is later persisted by store, or whether an expired cache entry remains available through store for the same remote.

Does Git automatically write a credential returned by cache into store when both helpers are active? If cache discards a credential after its timeout, can store still supply it for the same host? Is there a supported mechanism to move credentials from cache to store without prompting the user again?

Tasadduq Burney · Answer

Direct answer
No. Git does not automatically copy a credential returned by the cache helper into the store helper, and an expired cache entry is not available through store unless that same credential was already written to ~/.git-credentials independently. There is no built-in Git command to migrate credentials from cache to store after the cache timeout expires.
Confirmed behavior

credential.helper controls lookup order for git credential fill; the first helper that returns a match wins.
The cache helper keeps secrets in a per-user daemon until its timeout, for example cache --timeout=3600.
The store helper appends credentials to ~/.git-credentials, or the path set by credential.store, with no expiration.
Cache expiry does not remove, create, or affect entries already in store.
Platform credential managers, such as macOS keychain or Windows Credential Manager, can take precedence depending on the Git build.

Steps for this case

Confirm the configured helpers and order:
git config --get-regexp 'credential\.helper'
Check whether the host credential already exists in plaintext store:
cat ~/.git-credentials
If the cache entry is still valid, test whether store can absorb it without a new prompt. This depends on helper and build support:
printf 'protocol=https
host=example.com
' | git credential fill
printf 'protocol=https
host=example.com
' | git credential approve
If you rely on store going forward, restrict file permissions:
chmod 600 ~/.git-credentials

Assumptions and uncertainty
This assumes standard Git 2.x builds with the built-in cache and store helpers. Behavior can differ by Git build, platform, or third-party credential helpers. The fill-to-approve path is not a supported migration command and only works while cache still holds the secret.
Missing diagnostic detail
Has the cache entry already expired, or is the cache daemon still holding the credential? This determines whether you can persist it to store without re-entering the password, or whether store must already contain it to avoid a prompt.

Git credential cache and store backend interoperability

1 answer

Direct answer

Confirmed behavior

Steps for this case

Assumptions and uncertainty

Missing diagnostic detail

Your perspective belongs here.

0 question comments