Git's credential helper failed to provide authentication credentials for a remote operation. This typically occurs when the configured credential helper cannot find stored credentials, is misconfigured, or when cached credentials have expired.
When you see "fatal: credential helper did not return password", Git is telling you that it asked a configured credential helper program for authentication credentials, but the helper failed to provide a password or token. Git credential helpers are external programs that store and retrieve authentication credentials so you don't have to type them every time. Common helpers include: - **credential-cache**: Stores credentials in memory temporarily (default 15 minutes) - **credential-store**: Stores credentials in a plain-text file (~/.git-credentials) - **credential-manager** (Windows): Uses Windows Credential Manager - **osxkeychain** (macOS): Uses macOS Keychain - **libsecret** (Linux): Uses the GNOME Keyring or similar This error means the helper was invoked but returned empty-handed. The credential helper might not have any stored credentials for that repository, the stored credentials may have been deleted or expired, or the helper program itself may be misconfigured or missing.
First, identify what credential helper Git is trying to use:
# Check all credential helper settings
git config --list | grep credential
# Check specific scopes
git config --global credential.helper
git config --system credential.helper
git config --local credential.helperIf nothing is returned, no credential helper is configured and Git will prompt for credentials each time. If multiple helpers are listed, Git tries each in order until one returns credentials.
Set up a credential helper based on your operating system:
Windows:
git config --global credential.helper manager
# For older Git versions (before 2.39):
git config --global credential.helper manager-coremacOS:
git config --global credential.helper osxkeychainLinux:
# Use libsecret (GNOME Keyring) - most secure
git config --global credential.helper /usr/share/doc/git/contrib/credential/libsecret/git-credential-libsecret
# Or use the cache helper (stores in memory for 15 minutes)
git config --global credential.helper cache
# Or use the store helper (stores in plain text - less secure)
git config --global credential.helper storeRemove any stale or incorrect credentials:
Using Git's credential reject command:
# Clear credentials for a specific host
echo "url=https://github.com" | git credential reject
echo "url=https://gitlab.com" | git credential rejectWindows Credential Manager:
1. Open Control Panel > Credential Manager
2. Select "Windows Credentials"
3. Find entries starting with "git:" or containing your Git host
4. Click the entry and select "Remove"
macOS Keychain:
# Remove from Keychain via command line
security delete-internet-password -s github.com
# Or open Keychain Access app and search for github.comLinux (~/.git-credentials file):
# View current credentials
cat ~/.git-credentials
# Remove specific entry or delete the file
rm ~/.git-credentialsAfter clearing, the next Git operation will prompt for new credentials.
Most Git hosting services now require Personal Access Tokens (PATs) instead of passwords:
GitHub:
1. Go to Settings > Developer settings > Personal access tokens > Tokens (classic)
2. Click "Generate new token"
3. Select scopes: at minimum repo for private repos
4. Copy the token immediately (you won't see it again)
GitLab:
1. Go to User Settings > Access Tokens
2. Create a token with read_repository and write_repository scopes
When prompted by Git:
git push origin main
Username: your-username
Password: <paste your PAT here, not your account password>The credential helper will store this token for future use.
You can manually store credentials using the credential helper:
# Interactive method - stores whatever you type
git credential approve <<EOF
protocol=https
host=github.com
username=your-username
password=your-token-or-password
EOFOr directly in the store file (less secure):
# Add to ~/.git-credentials
echo "https://username:[email protected]" >> ~/.git-credentialsImportant: Never commit credentials to your repository. The .git-credentials file should only exist in your home directory.
If using the store helper, ensure proper file permissions:
# Check current permissions
ls -la ~/.git-credentials
# Set restrictive permissions (owner read/write only)
chmod 600 ~/.git-credentials
# Verify ownership
chown $USER ~/.git-credentialsIf the file doesn't exist but should:
touch ~/.git-credentials
chmod 600 ~/.git-credentialsEnable Git's credential debugging to see what's happening:
# Set debug environment variable
export GIT_TRACE=1
export GCM_TRACE=1 # For Git Credential Manager
# Run the failing command
git push origin mainYou can also test the credential helper directly:
# Test if helper can retrieve credentials
echo "protocol=https
host=github.com" | git credential fill
# Should output username and password if credentials existIf this returns nothing or errors, the helper has no stored credentials for that host.
If credential helpers are conflicting or corrupted, reset and reconfigure:
# Remove all credential helper configs
git config --global --unset-all credential.helper
git config --system --unset-all credential.helper 2>/dev/null
# Verify it's cleared
git config --list | grep credential
# Set up fresh
git config --global credential.helper store # Or your preferred helperFor Git Credential Manager issues on Windows:
# Reinstall GCM
winget install Git.Git
# During installation, ensure "Git Credential Manager" is selectedCredential helper precedence: When multiple helpers are configured, Git tries them in order. The first helper to return credentials "wins". You can stack helpers:
git config --global credential.helper cache # Try cache first
git config --global --add credential.helper store # Fall back to storePer-repository credentials: You can configure different credentials for different hosts:
git config --global credential.https://github.com.username myGitHubUser
git config --global credential.https://gitlab.com.username myGitLabUserGit Credential Manager (GCM) vs legacy helpers: GCM (included with Git for Windows and available for macOS/Linux) supports OAuth, MFA, and multiple accounts. It's generally recommended over the simpler store/cache helpers.
Environment variables for CI/CD: In automated environments, set credentials via environment:
# GitHub Actions example
git config --global url."https://x-access-token:${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"SSH as an alternative: If HTTPS credential issues persist, consider switching to SSH authentication:
# Change remote from HTTPS to SSH
git remote set-url origin [email protected]:user/repo.gitSSH uses keys instead of passwords, avoiding credential helper issues entirely.
Timeout for cache helper: The cache helper forgets credentials after 15 minutes by default. Increase this:
git config --global credential.helper 'cache --timeout=86400' # 24 hourskex_exchange_identification: Connection closed by remote host
Connection closed by remote host when connecting to Git server
fatal: unable to access: Proxy auto-configuration failed
How to fix 'Proxy auto-configuration failed' in Git
fatal: unable to access: Authentication failed (proxy requires basic auth)
How to fix 'Authentication failed (proxy requires basic auth)' in Git
fatal: unable to access: no_proxy configuration not working
How to fix 'no_proxy configuration not working' in Git
fatal: unable to read tree object in treeless clone
How to fix 'unable to read tree object in treeless clone' in Git