DEV Community

loading...
Cover image for How to never type passwords when using Git
GitHub

How to never type passwords when using Git

Michelle Mannering
Developer Relations | Hackathon Queen | Community Manager
・Updated on ・5 min read

Have you been using Git on the command line? Notice how you have to always type in your password? Not only is this SUPER annoying, it also presents a security issue. Here's a bunch of ways to authenticate Git so you don't have to type a password with every action. It will also keep your code more safe and secure.

If you're using Git and GitHub then there are a few ways to authenticate to ensure your code is secure.

SSH keys

If you work in tech, you've probably heard the term SSH keys. The term often comes up when you're trying to login or use a cloud service outside a web browser. It's also a term associated with connecting from one machine to another.

SSH or Secure Shell keys is the name of the key (or protocol) used when you need to authenticate in order to use a provider. Using SSH protocol makes a network much more secure. Someone can't just login remotely from one system into another. Instead, the encryption is used to manage this login and therefore secure your login details.

There are lots of different types of SSH keys. If you're on Windows, it's pretty easy to authenticate as you'll see below. If you're using macOS, you can generate SSH keys in order to authenticate your GitHub account. Check out the GitHub Docs for how to manually generate keys.

Personal Access Tokens

You don't just have to use the terminal in order to generate keys. If the command line isn't your cup of tea, then you can generate keys from the GitHub web:

  1. Go to GitHub.com
  2. Select "Settings"
  3. Scroll down and select "Developer Settings" from the left
  4. Select "Personal Access Tokens" from the left
  5. Create your Token Tokens

In these settings you can generate and manage tokens.

OAuth Applications

There's also a way for you to track which applications have access to your GitHub account:

  1. Go to GitHub.com
  2. Select "Settings"
  3. Scroll down to "Applications"
  4. Click "Authorized OAuth Apps"

Now you can see which applications have access to your GitHub account and revoke any if necessary.

OAuth

Note, this isn't the same place as your Developer Settings OAuth Apps. If you are creating applications and you want to enable GitHub authentication, then check out the GitHub Docs on creating and authorising OAuth apps.

Credential Manager

Unless you're a Windows user (πŸ‘‹ there) you would have noticed you need to enter your password with every Git operation. When you install Git on Windows, a credential manager is automatically installed on your computer. This means you only need to log into your account once and then you are authenticated.

We can replicate this on macOS and Linux as well. Using a client manager such as Git Credential Manager Core (GCM Core) is one way to do single-factor authentication on macOS and Linux. The Linux version of this is still in preview, but you can try it out now.

GitHub logo microsoft / Git-Credential-Manager-Core

Secure, cross-platform Git credential storage with authentication to GitHub, Azure Repos, and other popular Git hosting services.

Git Credential Manager Core

Build Status


Git Credential Manager Core (GCM Core) is a secure Git credential helper built on .NET that runs on Windows and macOS. Linux support is in an early preview.

Compared to Git's built-in credential helpers (Windows: wincred, macOS: osxkeychain, Linux: gnome-keyring) which provides single-factor authentication support working on any HTTP-enabled Git repository, GCM Core provides multi-factor authentication support for Azure DevOps, Azure DevOps Server (formerly Team Foundation Server), GitHub, and Bitbucket.

Git Credential Manager Core (GCM Core) replaces the .NET Framework-based Git Credential Manager for Windows (GCM), and the Java-based Git Credential Manager for Mac and Linux (Java GCM), providing a consistent authentication experience across all platforms.

Current status

Git Credential Manager Core is currently available for macOS and Windows, with Linux support in preview. If the Linux version of GCM Core is insufficient then SSH still remains an option:

If you want to try a few things other than the Git command line or webpage, there are a few options.

Authenticate with GitHub Desktop

After GitHub Desktop was launched a couple of years ago, this application has been a great way to use GitHub. Not only can you can you manage your repos, but it's a great way to authenticate and manage your account.

Download GitHub Desktop and log into your account. This will open a browser window so you can authenticate. There's also a light and dark mode!

DesktopZoom

In a similar way you can also authenticate various applications such as editors like VS Code or Atom or other git clients like Git Kraken. Don't forget you can go into OAuth settings to see which applications you've given access to GitHub.

GitHub CLI

Yes it's still the command line, but GitHub has its own CLI. You can download it then use gh auth login and follow the steps. This will allow access to your GitHub account and you can continue using the command line as normal. You can even use gh auth login --with-token to use a personal token.

v1

The CLI is available on Windows, macOS, and Linux. It's completely free and it's open source so you can even contribute to it.

Using physical security keys

Lately, physical security keys, such as a YubiKey, have been very popular. They are a great way to secure and can't be replicated.

YubiKey

YubiKeys are also really easy to setup as 2FA:

  1. Go to GitHub.com
  2. Click "Account Security"
  3. Scroll down to "Security keys" and click "edit"
  4. Select "Register new security key" and follow the prompts

If you decide to setup a security key, you'll need to save your recovery codes in a secure location. If you have 2FA or security keys for your account, recovery codes are the only way to access your account if you lose your YubiKey or can't use your 2FA. It was also recently announced that you can use a YubiKey as your SSH private key. Check out the YubiKey blog to read more about the announcement and how to setup your YubiKey.

YubiKeys are also really great because they can be used on desktops, laptops, and mobile phones. There's a bunch of different types from Lighting, to USB-A, USB-C, and even NFC. Read more about security keys on the GitHub Docs.

Up your security and save time

Hopefully that gives you some ideas on how to take your security to the next level AND save time by not typing in your password with every Git command. If you want to read more about security keys or SSH keys, check out the GitHub blog.

I'm curious to know what everyone's preferred method of authentication is. Let me know below.

Discussion (7)

Collapse
cblte profile image
cblte

Good morning.
There is no need to install any additional software. You can use Git with your standard ssh configuration by creating a keypair locally and set the public key in your GitHub preferences.

docs.github.com/en/github/authenti...

After that create a β€žconfigβ€œ file in your .ssh directory and add some information to it then git uses the ssh credentials with your newly created key.

The complete setup is described here devconnected.com/how-to-setup-ssh-...

Collapse
manish profile image
Manish Sinha

Unless you're a Windows user (πŸ‘‹ there) you would have noticed you need to enter your password with every Git operation

I was wondering about this statement. I use macOS and never have to enter password for every git operation. The git credentials manager is great, but one can use the old and trusted ssh-agent for managing ssh keys which avoids the need for password prompt.

Or I am misunderstanding. The password is prompted for every operation if using https protocol? Maybe that is indeed the case, but I never use it since ssh protocol is easiest to manage.

Collapse
justisgipson profile image
Justis

No mention of using Mac OS Keychain Access?

Works great and you can add

[credential] 
        helper = osxkeychain
Enter fullscreen mode Exit fullscreen mode

to your .gitconfig

Collapse
llbbl profile image
Logan Land

Going to send to all the noobs still using https with git-hub/lab and putting in their password on each commit. <3

Collapse
mishmanners profile image
Michelle Mannering Author

Oh yay, so glad it's useful.

Collapse
aaronngray profile image
Aaron Gray • Edited

Seems like you only give half the story... So you have a Personal Access Token, so what do you do with it ? How do you make git permanently eat it ?

Collapse
vitalykarasik profile image
Vitaly Karasik

Just yesterday I noticed that I'm able to use Github via HTTPS without password (git CLI on Mac). I'm still curious why.