opschain git-credentials update
Included from Basic tier
opschain git-credentials update <id|name> [--project <code>] [--rename <name>] [credential flags]
Updates a credential in place — the rotation verb. Only what is supplied is sent: an omitted field keeps its stored value, and the kind never changes. Because remotes resolve the reference at use time, every remote referencing the credential picks the new values up on its next fetch or clone, with no write to any remote.
The credential is addressed by id or by its name within the scope
(--project <code>, or the global registry without it); a mutation only
reaches the scope's own credentials — a project never edits the global
registry, nor the reverse (an out-of-scope credential reads not-found).
Explicit empties clear where the server allows it: --username "" clears
the stored username and --clear-passphrase the SSH passphrase. The
password of an https_basic credential and the key of an ssh_key one
can only be replaced, never cleared (the server refuses a blank). The
credential flags work exactly as on create.
Flags
| Flag | Meaning |
|---|---|
--project <code> | The project whose registry holds the credential. Omit for the global registry. |
--rename <name> | New name (unique within the scope). |
--username <user> | Replace the stored username; --username "" clears it. |
--password-env <VAR> | Replace the HTTP(S) password/token with the named environment variable's value. |
--password-prompt | Replace it with a value read without echo (mutually exclusive with the env form). |
--passphrase-env <VAR> | Replace the SSH key passphrase. |
--ssh-key-file <path> | Replace the SSH private key with this file's contents. |
--clear-passphrase | Clear the stored SSH key passphrase (mutually exclusive with --passphrase-env). |
Exit codes
| Code | Meaning |
|---|---|
| 0 | Updated — prints `updated git credential <id |
| 1 | The credential was not found in the scope, or the server refused the patch (a duplicate name, the other kind's field, a blank password or key). |
| 2 | Usage error — nothing supplied, credential flag misuse, no server target. |
Named errors
nothing to update — pass --rename and/or a credential flag— exit 2.--password-env and --password-prompt are mutually exclusive— exit 2.--clear-passphrase and --passphrase-env are mutually exclusive— exit 2.--password-env <VAR>: the environment variable is not set (or empty)— and the--passphrase-envtwin — exit 2.the server answered not_found: …— no such credential in the scope (exit 1).
Examples
Rotate a PAT once, for every remote that references it:
opschain git-credentials update github-ci --project acme --password-env NEW_GIT_TOKEN
updated git credential github-ci
Replace a global deploy key and drop its passphrase:
opschain git-credentials update deploy-key --ssh-key-file ~/.ssh/opschain_deploy_2 --clear-passphrase
See also
opschain docs cli/git-credentials-test— verify the rotated value.opschain docs cli/git-remotes-update— rotating a remote's inline credentials instead, or moving it to a reference.