102

I need to disable the credential helper for OS X: git credential-osxkeychain

It is disabled both in the global config file and in the local one, in fact it has never ben enabled. Still, it keeps memorizing my github login details.
I'm on a laptop, so I don't want automatic passwordless access to my repos.
I will use ssh keys. This is a new computer, and the whole system setup is still a work in progress.
For now I used the https repo refs, and the credential helper keeps kicking in.

These are my conf files:


git config --edit =>

[core]
    repositoryformatversion = 0
    filemode = true
    bare = false
    logallrefupdates = true
    ignorecase = true
    precomposeunicode = false
[remote "origin"]
    url = https://github.com/user/repo.git
    fetch = +refs/heads/*:refs/remotes/origin/*
[branch "master"]
    remote = origin
    merge = refs/heads/master
[branch "develop"]
    remote = origin
    merge = refs/heads/develop
[branch "deploy"]
    remote = origin
    merge = refs/heads/deploy

git config --global --edit =>

[user]
    email = ****************
    name = tom
[color]
    ui = true
[core]
    editor = subl -w
[github]
    user = tompave
[merge]
    conflictstyle = diff3
[push]
    default = simple

Also, running git config --global credential.helper returns nothing (and that's right).

However, running git config credential.helper returns osxkeychain!

How is it possible? I can't see it in the local config file, where is it set?

I tried to set it up locally to see what would happen, and it did appear in the repodir/.git/config. Then I deleted the entry... but the helper is still here and active.

I can clearly see its entry in OS X keychain.
I can delete it, and then git will ask for the password again... but as soon as I type it (let's say, for a git fetch), the entry in keychain is restored.

7 Answers 7

155

To help track down the setting, I'd try to use:

git config --local credential.helper
git config --global credential.helper
git config --system credential.helper

The first one checks the local repo config, the second is your ~/.gitconfig, and the third is based on where git is installed. Depending on which one comes back showing the credential helper, you can try using the equivalent --unset option:

git config --local --unset credential.helper
git config --global --unset credential.helper
git config --system --unset credential.helper

The last one may not work if you don't have proper permissions. So you may need to run the last one under sudo for it to work correctly. FWIW, you may have installed for the pre-built git images for Mac OS X. If you cat /usr/local/git/etc/gitconfig (or /usr/local/etc/gitconfig if you installed git via Homebrew or a building locally), you'll see that it does set up the credential helper for you. So the last command above would help fix that problem.

12
  • 1
    sounds similar to my answer, but with more practical comamnds, so +1.
    – VonC
    Apr 17, 2013 at 7:52
  • Thanks. I was misinterpreting the output, as I thought that git config regarded the local options... and wasn't aware of --system. now the command git config --system --edit clearly shows the osxkeychain option, and I can unset it. Judging from the output, it looks like that git config --edit is interpreted with the --local option enabled by default.
    – tompave
    Apr 17, 2013 at 19:01
  • 1
    On my Mac, the system level config file is /usr/local/etc/gitconfig, not /usr/local/git/etc/gitconfig. Aug 9, 2018 at 15:55
  • 5
    None of those return anything, but git config credential.helper is still osxkeychain
    – minseong
    Apr 10, 2019 at 15:51
  • 20
    @minseong These days you can use git config --show-origin credential.helper to show where it's coming from. Give that a try and then you know where to got and fix the problem. :-) Apr 10, 2019 at 19:53
91

The other answers were very helpful. The credential.helper didn't show for me in any of the listings (specifying --local, --global, etc) and it always showed on a 'git config -l'. Using the --show-origin command showed that it was coming from an OS X-specific file.

$ git config --show-origin --get credential.helper
file:/Applications/Xcode.app/Contents/Developer/usr/share/git-core/gitconfig    osxkeychain
3
  • 4
    THANK you for the --show-origin. I had to use git config --list --show-origin to see where the osxkeychain helper got referenced and change that config.
    – luk2302
    Jul 10, 2017 at 8:33
  • So how would I disable the keychain from there?
    – A. L
    Sep 5, 2017 at 23:45
  • 10
    @A.Lau using sudo vi WhatEverLocationIsShownAfter"file:" and removing the line that sets the credential helper.
    – luk2302
    Oct 12, 2017 at 18:59
27

It my case it was easier to run:

git config --get-all --show-origin credential.helper

Which outputs the full list including config file paths:

file:/Library/Developer/CommandLineTools/usr/share/git-core/gitconfig   osxkeychain
file:/Users/yourname/.gitconfig !aws codecommit credential-helper $@

Then open the config file:

sudo vim /Library/Developer/CommandLineTools/usr/share/git-core/gitconfig

And comment out the line credential.helper=osxkeychain

1
  • 1
    That's the path I had to take. +1
    – Flip
    Nov 12, 2021 at 12:31
13

Note: in GitHub, with passwords being deprecated in favour of tokens, this problem may come up again for many users.
In my case (macos 11.5 BigSur) the command line config git config --unset credential.helper did not help, nor did any variations on the local, global or system levels. The help from GitHub did not solve the issue either.

The solution was:

  1. look for the config files using git config --get-all --show-origin credential.helper, as mentioned by Kim T above.You'll probably get and output like:
    file:/usr/local/git/etc/gitconfig osxkeychain
    file:/Users/XYZ/.gitconfig osxkeychain

  2. If you're a macos newbie as I am, you might need to navigate to the file location. Just copy each output from the show-origincommand above, go to Finder and in the Go menu select 'Go to Folder', then paste the file location.

  3. in each of the config files, comment out osxkeychain, as featured below:
    [credential]
    helper = osxkeychain
    should become
    #[credential]
    # helper = osxkeychain
    You might need to acquire permissions to edit the files. Either use sudo when editing in the command line or go to "Get Info" on the menu when right-clicking the file in Finder.

  4. Then push or pull from the repo. You'll be asked for your password again, but should now provide your personal access token instead.

And voilà, magic should happen.

1
  • 1
    confirmed commenting it out stops the git config --get-all --show-origin credential.helper from finding any value. However i was still not able to receive the prompt to enter password. Found that I had a ~/.netrc that was stopping that. Renamed the file and then the magic happened for me!
    – Norbert
    Jan 7, 2022 at 14:23
4

The config itself (git config --unset credential.helper) isn't enough.
Make sure to kill any git-credential-osxkeychain process (as described here) as well, or see if the issue persists after a reboot.

Also, when using GitHub for Mac, check if there is a config used internally by this tool.
Remember that git config alone will check for system, global and local config file.

Note: with git 2.9, you can simply set the credential.helper to "empty string" in order to disable it: see "How do I disable git's credential helper for a single repository?".

1
  • I think you missed something VonC. Your link doesn't go anywhere. :-( Apr 17, 2013 at 7:29
2

On MacOS 12.1 none of unset commands did the job.

However, the following worked:

git config --add credential.helper ""

Which allowed to prevent git to store password in the keychain.

0

This will show all the files:

git config -l --show-origin | grep credential

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.