Git Access (OAuth-PAT)

Authenticate the git CLI on git.eu with the OAuth credential helper, a personal access token, or the headless device flow.

Git Access (OAuth-PAT)

Authenticate the git command-line client over HTTPS with OAuth - no password, no token to copy. Scripts and CI use a personal access token instead (Method B).

Find Your Instance Values

Settings → Git Access → Tokens shows the exact git config block generated for your account, ready to paste.

Open Settings → Git Access → Tokens

Method A - OAuth (git-credential-oauth)

The recommended setup for interactive use: install the helper once, sign in through your browser the first time, tokens refresh automatically after that.

Step 1 - Install

Install git-credential-oauth for your platform:

Git auto-discovers any git-credential-* executable on your PATH.

Windows

Scoop

scoop install git-credential-oauth

winget

winget install hickford.git-credential-oauth

Chocolatey

choco install git-credential-oauth

Download the binary

Download the Windows binary from the releases page and place it anywhere on your PATH.

macOS

Homebrew

brew install git-credential-oauth

Linux

Debian

sudo apt install git-credential-oauth

Packaged in Debian 13 (Trixie) and later. On Debian 12 or older, use the binary fallback below.

Ubuntu

sudo apt install git-credential-oauth

Available in Ubuntu 24.04 LTS and later (universe). On older releases, enable universe or use the binary fallback below.

Other distributions (Go toolchain, or prebuilt binary)

go install github.com/hickford/git-credential-oauth@latest

Or download a prebuilt binary for your OS/arch from the releases page and place it on your PATH.

Verify with git credential-oauth --version - it should print a version string.

Step 2 - Configure

Add the helper and your instance's OAuth endpoints to your global git config:

git config --global --add credential.helper store
git config --global --add credential.helper oauth
git config --global credential.https://<INSTANCE>.git.eu.oauthClientId giteu-git
git config --global credential.https://<INSTANCE>.git.eu.oauthAuthURL https://<INSTANCE>.git.eu/oauth/authorize
git config --global credential.https://<INSTANCE>.git.eu.oauthTokenURL https://<INSTANCE>.git.eu/oauth/token
git config --global credential.https://<INSTANCE>.git.eu.oauthDeviceAuthURL https://<INSTANCE>.git.eu/oauth/device/code
git config --global credential.https://<INSTANCE>.git.eu.oauthScopes "repo:read repo:write"

The client id (giteu-git) and scopes are the same on every instance - only the host varies.

Step 3 - Use it

Create the empty repository on your instance first (web UI: New repository). The first git command opens your browser to sign in and approve.

Start from scratch

git clone https://<INSTANCE>.git.eu/<USERNAME>/REPO_NAME.git
cd REPO_NAME

Migrate an existing repository - push --mirror pushes every branch, tag, and ref:

git remote remove origin
git remote add origin https://<INSTANCE>.git.eu/<USERNAME>/REPO_NAME.git
git push --mirror origin

Step 4 - Useful commands

Inspect what is stored

cat ~/.git-credentials

Warning - plaintext. The store helper writes your credentials to ~/.git-credentials unencrypted. Prefer your OS keychain helper when possible, and keep the file readable by your user only.

Reject a stored credential for one host - the next operation asks you to sign in again:

printf 'protocol=https\nhost=<INSTANCE>.git.eu\n\n' | git credential reject

Remove all stored credentials

rm ~/.git-credentials

Warning - destructive. This removes every stored credential, for every host. You will be asked to sign in again on the next git operation.

Method B - PAT

A personal access token is a long-lived secret - pick it for scripts, CI jobs, and GUI clients. Every step (create, use, cache) is in Clone and Push over HTTPS.

Headless / Docker

No browser (CI runner, container, SSH session)? Method A's helper falls back to the OAuth device flow.

Step 1 - Trigger the flow

Run your normal git command; the helper prints a verification URL and a user code:

To authenticate, visit:

  https://<INSTANCE>.git.eu/oauth/device

and enter the code: ABCD-1234

Step 2 - Approve on another device

On any device with a browser, open the verification URL, sign in, and enter the user code.

Step 3 - Wait for the exchange

The headless process completes automatically once you approve. Device codes are short-lived: if the code expired, re-run the git command to get a fresh one.

Device-flow tokens carry the same scopes and lifetime as an interactive login. Revoking the authorized application later (from the authorized applications section of Settings → Git Access → Tokens) invalidates them.

Troubleshooting

No prompt appears at all. Confirm the credential helper is actually configured for your instance's host - run git config --global --get-all credential.helper and check the credential.https://<INSTANCE>.git.eu.* keys match your instance exactly (including scheme).

Login succeeds but every push still asks again. The store helper must run before the oauth helper in the chain (see Method A, Step 2) so refreshed tokens are cached to disk.

"Invalid scope" or "insufficient scope" errors. Your token was issued before a scope was added to your account's grant. Revoke the authorized application in Settings → Git Access → Tokens and re-authenticate to pick up the current scope list.

Every other HTTPS sign-in error (a refused token, Access denied, could not read Username), with its fix: Knowledge Base - HTTPS Authentication.

About

<INSTANCE> (your instance slug, for example beta2) and <USERNAME> (your account name) resolve automatically in commands and buttons when you are signed in on this site; otherwise swap them for your own values. The values are instance-specific by design - never hardcode a client id, endpoint, or scope list copied from someone else's setup.

Next Steps

Ready to get started?

Manage your tokens and OAuth apps