opschain git-credentials create

Included from Basic tier

opschain git-credentials create --name <name> --kind https_basic|ssh_key [--project <code>] [credential flags]

Creates a named credential in a project's registry (--project) or the instance-global one (no --project; needs the /admin determination). The name is unique within its scope and is how a remote may reference the credential besides its id. The kind is fixed at create:

• https_basic carries --username plus a password or token: --password-env <VAR> names an environment variable holding it, or --password-prompt reads it without echo (a plain line read when stdin is piped). The server refuses an https_basic credential without a password, and refuses a passphrase or key on it.
• ssh_key carries --ssh-key-file <path> — the private key file, read from disk and sent as the key's contents — optionally protected by a passphrase from --passphrase-env <VAR>; --username supplies the SSH user where the remote URL carries none. The server refuses an ssh_key credential without key data, and refuses a password on it.

Credentials never travel through argv and never live in files other than the key file itself. The server stores them encrypted and never returns their values; the create prints the id, kind and scope only.

Flags

Flag	Meaning
--name <name>	The credential's name, unique within its scope (required).
--kind <kind>	https_basic or ssh_key (required; fixed at create).
--project <code>	Create in this project's registry. Omit for the global registry.
--username <user>	The username (HTTP(S) basic auth, or the SSH user).
--password-env <VAR>	Name of an environment variable holding the HTTP(S) password or token — never the value itself.
--password-prompt	Prompt for the HTTP(S) password or token without echo. Mutually exclusive with --password-env.
--passphrase-env <VAR>	Name of an environment variable holding the SSH key's passphrase.
--ssh-key-file <path>	Path to the SSH private key.

Exit codes

Code	Meaning
0	Created — prints created git credential <name> (<kind>, <scope> scope, <id>).
1	The server refused the create (a duplicate name in the scope, a missing password or key for the kind, the other kind's field, a global create without the admin determination, no encryption keys configured on the server), or the SSH key file could not be read.
2	Usage error — missing --name/--kind, credential flag misuse, no server target.

Named errors

• a git credential needs --name and --kind (https_basic or ssh_key) — exit 2.
• --password-env and --password-prompt are mutually exclusive — exit 2.
• --password-env <VAR>: the environment variable is not set (or empty) — and the --passphrase-env twin — exit 2.
• no password provided (pipe it on stdin, or run from a terminal) — the prompt read nothing (exit 2).
• reading the SSH key file: <error> — exit 1.
• Password can't be blank for https_basic Git credentials / Ssh key data can't be blank for ssh_key Git credentials — the server's kind rules (exit 1).
• git credentials live on a server's projects — pass --server <url> or 'opschain context use <name>' — no server target (exit 2).

Examples

A project-scoped GitHub PAT, token from the environment:

opschain git-credentials create --project acme --name github-ci \
  --kind https_basic --username ci-bot --password-env GIT_TOKEN
created git credential github-ci (https_basic, acme scope, 0199c8…)

A global deploy key with a passphrase:

opschain git-credentials create --name deploy-key --kind ssh_key \
  --ssh-key-file ~/.ssh/opschain_deploy --passphrase-env KEY_PASSPHRASE

Then point a remote at it with the reference flag of opschain git-remotes create (opschain docs cli/git-remotes-create), naming the credential by name or id instead of passing inline values.

See also

• opschain docs cli/git-remotes-create — the reference flag on a remote.
• opschain docs cli/git-credentials-test — prove the credential reaches the repository before any remote depends on it.
• opschain docs resources/git_credential — scoping and authorization.