97

I need to disable the credential helper for OS X: git credential-osxkeychain

It is disabled both in the global config file and in the local one, in fact it has never ben enabled. Still, it keeps memorizing my github login details.
I'm on a laptop, so I don't want automatic passwordless access to my repos.
I will use ssh keys. This is a new computer, and the whole system setup is still a work in progress.
For now I used the https repo refs, and the credential helper keeps kicking in.

These are my conf files:

git config --edit =>

[core]
    repositoryformatversion = 0
    filemode = true
    bare = false
    logallrefupdates = true
    ignorecase = true
    precomposeunicode = false
[remote "origin"]
    url = https://github.com/user/repo.git
    fetch = +refs/heads/*:refs/remotes/origin/*
[branch "master"]
    remote = origin
    merge = refs/heads/master
[branch "develop"]
    remote = origin
    merge = refs/heads/develop
[branch "deploy"]
    remote = origin
    merge = refs/heads/deploy

git config --global --edit =>

[user]
    email = ****************
    name = tom
[color]
    ui = true
[core]
    editor = subl -w
[github]
    user = tompave
[merge]
    conflictstyle = diff3
[push]
    default = simple

Also, running git config --global credential.helper returns nothing (and that's right).

However, running git config credential.helper returns osxkeychain!

How is it possible? I can't see it in the local config file, where is it set?

I tried to set it up locally to see what would happen, and it did appear in the repodir/.git/config. Then I deleted the entry... but the helper is still here and active.

I can clearly see its entry in OS X keychain.
I can delete it, and then git will ask for the password again... but as soon as I type it (let's say, for a git fetch), the entry in keychain is restored.

Flip
  • 6,233
  • 7
  • 46
  • 75
tompave
  • 11,952
  • 7
  • 37
  • 63

6 Answers6

150

To help track down the setting, I'd try to use:

git config --local credential.helper
git config --global credential.helper
git config --system credential.helper

The first one checks the local repo config, the second is your ~/.gitconfig, and the third is based on where git is installed. Depending on which one comes back showing the credential helper, you can try using the equivalent --unset option:

git config --local --unset credential.helper
git config --global --unset credential.helper
git config --system --unset credential.helper

The last one may not work if you don't have proper permissions. So you may need to run the last one under sudo for it to work correctly. FWIW, you may have installed for the pre-built git images for Mac OS X. If you cat /usr/local/git/etc/gitconfig (or /usr/local/etc/gitconfig if you installed git via Homebrew or a building locally), you'll see that it does set up the credential helper for you. So the last command above would help fix that problem.

John Szakmeister
  • 44,691
  • 9
  • 89
  • 79
  • 1
    sounds similar to my answer, but with more practical comamnds, so +1. – VonC Apr 17 '13 at 07:52
  • Thanks. I was misinterpreting the output, as I thought that `git config` regarded the local options... and wasn't aware of `--system`. now the command `git config --system --edit` clearly shows the osxkeychain option, and I can unset it. Judging from the output, it looks like that `git config --edit` is interpreted with the `--local` option enabled by default. – tompave Apr 17 '13 at 19:01
  • A bare `git config` does *look* at them all. But when you go to change one, a bare `git config` will go for the local one. You really need one of `--global` or `--system` when you want to edit something other than the local git config. – John Szakmeister Apr 18 '13 at 09:01
  • It requires me to uninstall the OSX git and install the newest git before I can get it to work. – Carson Ip Jun 25 '15 at 08:42
  • Thanks, this solved my problem too. I ran into file permissions errors on the third command, but was able to take full control of the file and re-run the command. – Longblog Aug 26 '16 at 15:44
  • 1
    On my Mac, the system level config file is `/usr/local/etc/gitconfig`, not `/usr/local/git/etc/gitconfig`. – Jesse Hogan Aug 09 '18 at 15:55
  • @JesseHogan if you installed git via Homebrew, I believe that's true. IIRC, installing via the official package yields the other path. Unfortunately, that's the fun with having several different ways of getting an application. But thanks for the note! – John Szakmeister Aug 13 '18 at 13:40
  • on my Mac the system level config file was /Library/Developer/CommandLineTools/usr/share/git-core/gitconfig I commented the credentials line and the password was asked when accessing the repo – Packet Tracer Sep 18 '18 at 10:15
  • 5
    None of those return anything, but `git config credential.helper` is still `osxkeychain` – theonlygusti Apr 10 '19 at 15:51
  • 17
    @theonlygusti These days you can use `git config --show-origin credential.helper` to show where it's coming from. Give that a try and then you know where to got and fix the problem. :-) – John Szakmeister Apr 10 '19 at 19:53
  • credential.helper=osxkeychain caused me a lot of pain. managing multiple github accounts is already tedious and confusing, and this adds yet another layer of complexity. TY for this great answer it solved my issues. – ICW Dec 12 '22 at 04:47
85

The other answers were very helpful. The credential.helper didn't show for me in any of the listings (specifying --local, --global, etc) and it always showed on a 'git config -l'. Using the --show-origin command showed that it was coming from an OS X-specific file.

$ git config --show-origin --get credential.helper
file:/Applications/Xcode.app/Contents/Developer/usr/share/git-core/gitconfig    osxkeychain
Andrew Goodnough
  • 1,068
  • 7
  • 8
  • 4
    THANK you for the `--show-origin`. I had to use `git config --list --show-origin` to see where the osxkeychain helper got referenced and change that config. – luk2302 Jul 10 '17 at 08:33
  • So how would I disable the keychain from there? – A. L Sep 05 '17 at 23:45
  • 10
    @A.Lau using `sudo vi WhatEverLocationIsShownAfter"file:"` and removing the line that sets the credential helper. – luk2302 Oct 12 '17 at 18:59
25

It my case it was easier to run:

git config --get-all --show-origin credential.helper

Which outputs the full list including config file paths:

file:/Library/Developer/CommandLineTools/usr/share/git-core/gitconfig   osxkeychain
file:/Users/yourname/.gitconfig !aws codecommit credential-helper $@

Then open the config file:

sudo vim /Library/Developer/CommandLineTools/usr/share/git-core/gitconfig

And comment out the line credential.helper=osxkeychain

Kim T
  • 5,770
  • 1
  • 52
  • 79
11

Note: in GitHub, with passwords being deprecated in favour of tokens, this problem may come up again for many users.
In my case (macos 11.5 BigSur) the command line config git config --unset credential.helper did not help, nor did any variations on the local, global or system levels. The help from GitHub did not solve the issue either.

The solution was:

  1. look for the config files using git config --get-all --show-origin credential.helper, as mentioned by Kim T above.You'll probably get and output like:
    file:/usr/local/git/etc/gitconfig osxkeychain
    file:/Users/XYZ/.gitconfig osxkeychain

  2. If you're a macos newbie as I am, you might need to navigate to the file location. Just copy each output from the show-origincommand above, go to Finder and in the Go menu select 'Go to Folder', then paste the file location.

  3. in each of the config files, comment out osxkeychain, as featured below:
    [credential]
    helper = osxkeychain
    should become
    #[credential]
    # helper = osxkeychain
    You might need to acquire permissions to edit the files. Either use sudo when editing in the command line or go to "Get Info" on the menu when right-clicking the file in Finder.

  4. Then push or pull from the repo. You'll be asked for your password again, but should now provide your personal access token instead.

And voilà, magic should happen.

Alexandre Pereira
  • 111
  • 1
  • 4
  • 1
    confirmed commenting it out stops the `git config --get-all --show-origin credential.helper` from finding any value. However i was still not able to receive the prompt to enter password. Found that I had a ~/.netrc that was stopping that. Renamed the file and then the magic happened for me! – Norbert Jan 07 '22 at 14:23
4

The config itself (git config --unset credential.helper) isn't enough.
Make sure to kill any git-credential-osxkeychain process (as described here) as well, or see if the issue persists after a reboot.

Also, when using GitHub for Mac, check if there is a config used internally by this tool.
Remember that git config alone will check for system, global and local config file.

Note: with git 2.9, you can simply set the credential.helper to "empty string" in order to disable it: see "How do I disable git's credential helper for a single repository?".

Community
  • 1
  • 1
VonC
  • 1,262,500
  • 529
  • 4,410
  • 5,250
0

On MacOS 12.1 none of unset commands did the job.

However, the following worked:

git config --add credential.helper ""

Which allowed to prevent git to store password in the keychain.

Mickael Tardy
  • 311
  • 3
  • 6