Skip to content
GitPersonaGitPersona

Credentials

Credentials let a profile authenticate to Git hosts over HTTPS. GitPersona keeps the token in your operating system's credential vault and stores only non-secret metadata itself.

Overview

A credential records a host, a username, and a reference to a stored secret (a token or personal access token). It can be attached to a profile so it activates alongside that profile's identity.

Supported protocol and hosts

GitPersona manages HTTPS credentials. The data model is designed so other schemes can be added later without migration, but HTTPS is what is handled today.

Credentials are managed for these hosts:

  • github.com
  • gitlab.com
  • bitbucket.org
  • dev.azure.com
Note: This is an allow-list of hosts GitPersona knows how to write Git credential entries for — not a limit on where you can push. Your other remotes keep working through Git's normal credential handling.

Adding a credential

To add a credential you provide:

  • The host (one of the supported hosts).
  • The username for that account.
  • The token — held only in memory in transit and written straight to the OS vault.
  • Optionally a reveal PIN (see below).
  • Optionally the profile to attach it to.

You can update a credential later to rotate its token or change the username. Rotating the token re-applies it to the Git credential targets the profile uses, so pushes keep working without a manual reassignment.

Assigning and switching

Assigning a credential to a profile ties it to that identity. When the profile becomes active, its credential is the one Git uses for the matching host. Per-repository profile assignments also pin a path-scoped HTTPS credential so a bound repository always authenticates as the right account.

Reveal PIN

A credential can carry an optional reveal PIN. When set, it lets you read the stored token back later through a PIN-gated reveal step. The PIN is stored only as an Argon2 hash — never in plaintext — and revealing the token is the single action that ever surfaces secret material.

Tip: Created a credential without a PIN? You can set one afterward to make the token revealable.

How secrets are stored

This is the important distinction:

  • The secret(your token) lives exclusively in your OS's native secure storage — Windows Credential Manager, the macOS Keychain, or the Linux Secret Service. There is no plaintext fallback.
  • GitPersona's own store holds metadata only: host, username, timestamps, and whether a reveal PIN is set. The token is never a field there, never serialized, and never written to logs.
Warning: GitPersona never stores tokens in plaintext. For the full storage model, see Credential storage.