A Unified Approach to Git Authentication

Git Credential Manager (GCM) has consolidated the two older platform-specific credential helpers — GCM for Windows and GCM for Mac and Linux — into a single project. The previous source code repositories have been archived, and the unified GCM now ships with distributions such as Git for Windows. Reflecting this consolidation, the project has dropped the "Core" moniker from its name. The codebase has also relocated to its own GitHub organization, github.com/git-ecosystem, rather than remaining under the Microsoft or GitHub umbrellas, underlining its intent to remain an open, hosting-agnostic tool. All existing issues and pull requests have been migrated to the new home.

Credential helpers are becoming a necessity as GitHub, Bitbucket, and other hosts retire password-based authentication for Git operations. GCM's goal is to fill that role universally, regardless of where code is hosted or which operating system or editor is in use.

Running on Linux

A major gap in earlier GCM versions was Linux support. The new GCM offers Debian packages and tarballs (64-bit Intel) from the project's releases page. Since it is built on the .NET platform, porting to other Linux distributions should be straightforward. ARM64 support is planned for the future.

Acknowledging the diversity of Linux environments, GCM offers multiple credential storage back-ends. Besides GPG-encrypted files, the helper now supports the Secret Service API via libsecret (including the GNOME Keyring), giving Linux users a storage experience comparable to that on Windows and macOS.

Credentials Shared with WSL

For developers working in the Windows Subsystem for Linux (WSL), GCM enables all WSL installations to share credentials with the Windows host. This allows mixing and matching development environments without repeated authentication prompts.

GitLab Joins the Fold

Through a community contribution, GCM now has built-in support for GitLab, expanding beyond Microsoft- and GitHub-hosted repositories to another major platform.

GUI and Terminal Prompts

While many developers live in the terminal, a lot of GUI-based Git tools shell out to the git executable and may invoke a credential helper without any attached terminal. GCM has long offered full graphical prompts on Windows; by adopting the cross-platform .NET XAML framework Avalonia, GCM can now also present GUI prompts on macOS and Linux. Terminal prompts remain a first-class input method, including automatic detection of headless environments such as SSH sessions without display forwarding. Users who prefer text prompts can disable the GUI explicitly in the configuration.

Security-Oriented Credential Storage

Credential storage is a security-sensitive aspect of any helper. GCM stores generated credentials using the native security APIs on the major platforms — Windows Credential Manager on Windows and the login keychain on macOS. On Linux, additional back-ends are supported, including GPG-encrypted files. Users can select from these alternatives across all supported platforms.

For ephemeral or cloud shell environments, GCM also supports Git's own git-credential-cache helper, which is included in many Git distributions. This stores credentials temporarily in memory, avoiding a prompt on each fetch or push without making any permanent on-disk record.

Experimental Brokered Authentication on Windows

For enterprise settings, hardware-backed security modules such as the Trusted Platform Module (TPM) on Windows or the Secure Enclave on Apple platforms offer strong at-rest protection. Enforcing conditional access policies, however, is often complex and platform-specific. Authentication brokers simplify this by handling credential negotiation on the application's behalf and may integrate with OS features such as biometrics.

GCM has added experimental support for brokered authentication on Windows via the Web Account Manager (WAM), which debuted in Windows 10. WAM enables modern authentication experiences such as Windows Hello and applies conditional access policies from a work or school tenant. This experimental integration is currently limited to authenticating Microsoft work and school accounts against Azure DevOps; details on opting in and known issues are documented in the project.

Continuing Development

Since the July 2020 announcement of GCM Core, a broad set of incremental improvements has accumulated:

  • Automatic detection of on-premises / self-hosted instances
  • Support for GitHub Enterprise Server and GitHub AE
  • Shared Microsoft identity token caches with other developer tools
  • Better support for network proxies
  • Custom TLS/SSL root certificate support
  • Admin-less Windows installation
  • Improved command line handling and output
  • Enterprise default settings on Windows
  • Multi-user support
  • Enhanced diagnostics

The immediate roadmap focuses on maturing the authentication broker support, strengthening credential protection, and raising performance and compatibility across more environments.