opschain git-credentials
Included from Basic tier
Manages the shared git-credential registry: named credentials that Git
remotes reference through credential_ref instead of storing inline
values. The reference resolves at use time, so rotating one real-world
credential is one write — every referencing remote picks the new value up
on its next fetch or clone, with no write to any remote.
A credential lives in a scope: a project's registry (--project <code>), or the instance-global registry when --project is omitted
(global writes need the /admin determination). A project's remotes may
reference the project's own credentials or global ones — never another
project's. Every verb addresses a credential by id or by its name within
the scope (a project credential shadows a global one of the same name),
exactly as the server's GitCredentialService does.
Values are write-only: a password or token enters through an environment
variable or a no-echo prompt, an SSH key through a file, and the server
stores them encrypted and reports each only as present — list prints the
server's masked placeholder ({{hidden}}), never a value. Two kinds:
https_basic (username + password/PAT) and ssh_key (private key +
passphrase); the kind is fixed at create.
Credentials live on the server — every subcommand needs a server target
(--server <url>, OPSCHAIN_SERVER or the active opschain context).
| Subcommand | Does | Manual |
|---|---|---|
list [--project <code>] | List the credentials a scope can reference | opschain docs cli/git-credentials-list |
create --name --kind [--project] | Create a credential (credential flags) | opschain docs cli/git-credentials-create |
update <id|name> [--project] | Rotate or rename in place | opschain docs cli/git-credentials-update |
test <id|name> --url <url> [--project] | Probe the credential against a repository URL | opschain docs cli/git-credentials-test |
delete <id|name> [--project] --confirm | Delete (preview without --confirm; refused while referenced) | opschain docs cli/git-credentials-delete |
See also
opschain docs cli/git-remotes-create— point a remote at a credential with the reference flag instead of inline values.opschain docs resources/git_credential— the resource, its scoping and authorization, and the audit events.opschain learn 3.3— the guided tour of Git remotes, including the shared registry.