Question
OAuth PAT vs App Password in SourceTree: Which Supports Simple Credential Switching for Test Workflows?
Cig Cedar
0 reputation · 30 Apr 2024, 23:18 UTC
124.5K views
Loading…
0 reputation · 30 Apr 2024, 23:18 UTC
When configuring SourceTree to test a Git integration without exposing production credentials, a user can create a limited‑scope personal access token (OAuth‑based PAT) or an Atlassian app password for a test repository. Both mechanisms are stored in the native OS credential store and are reused for subsequent operations on the same host.
The unresolved behavior is that SourceTree does not provide a built‑in way to force a re‑prompt or to select which stored credential to use for a particular remote after the initial authentication; switching between test and production credentials currently requires manual intervention in the OS store. This makes it difficult to verify that the test token is being actively used during verification steps.
Which of the two credential methods offers a more straightforward way to alternate between test and production credentials without editing the OS store? Does SourceTree expose any UI option to clear or override cached credentials for a specific host? Is there a configuration that causes SourceTree to request credentials on each fetch/pull for a given remote?
35275 reputation · 01 May 2024, 10:20 UTC
Neither OAuth‑based PATs nor Atlassian app passwords provide a simple, SourceTree‑controlled way to toggle between test and production credentials. SourceTree stores both token types in the native OS credential manager and, once saved, re‑uses the same entry for all operations on the host. The UI has no option to clear or override a single host’s credentials, nor a setting that forces a re‑prompt for each fetch/pull.
git
oauth
sourcetreeCredential Manager (Control Panel > Credential Manager)Keychain Access (Applications > Utilities)secrets‑service (e.g., kwallet or gnome‑keyring)git:bitbucket.org or https://bitbucket.org.To avoid accidental deletion of a production credential, create a separate test account with minimal scopes and store its token in the OS store under a distinct host alias (e.g., bitbucket-test.org). Then add the test remote in SourceTree pointing to that alias. This keeps the two credentials isolated.
Which operating system are you using? The exact steps to locate and delete the credential entry differ between Windows, macOS, and Linux.
Use comments to ask for clarification. Post a solution as an answer.
35,275 reputation · 01 May 2024, 10:45 UTC
SourceTree treats OAuth‑based PATs and Atlassian app passwords identically – both are stored as generic credentials in the OS keychain and there is no UI to pick which one to use for a given remote after the first login.
If you need to verify that a test token is being used without editing the OS store, you can temporarily disable the Save password checkbox when adding or editing the remote. This forces SourceTree to prompt for credentials on every Git operation, so you can enter the test token each time and confirm it works, while the production token remains cached elsewhere.
Note that leaving Save password unchecked will prompt on every fetch/pull, which may interfere with automated scripts unless they supply credentials via Git’s credential.helper or environment variables.