Git credential

Included from Basic tier

A shared git credential: a named, node-scoped registry entry git remotes reference via credential_ref instead of storing inline values — rotating one real-world credential is one write, applied to every referencing remote on its next use. The N3 connector shape: values encrypted at rest with the server's encryption keys, masked on every read, with a test verb. The surface is GitCredentialService (API v2, PostgreSQL-backed); v1 carries no registry endpoints — its git-remote writes accept credential_ref, nothing more.

Fields

Field	Type	Meaning
name	string	Unique within its scope (the global registry, or one project). How a remote may reference the credential besides its id.
kind	string	https_basic (username + password/PAT) or ssh_key (private key + passphrase). Fixed at create. The set is open — a future github_app kind is a pure addition.
project_code	string, optional	The owning project; unset means the credential is instance-global.
user	string, optional	Masked. "{{hidden}}" when a username is stored, unset otherwise.
password	string, optional	Masked. The stored secret presented as a password when the kind is https_basic.
passphrase	string, optional	Masked. The same stored secret presented as a passphrase when the kind is ssh_key.
ssh_key_data	string, optional	Masked. "{{hidden}}" when a private key is stored.
created_at / updated_at	timestamp	Row timestamps.

Stored values are never materialised by the read path at all: the reader selects only a boolean presence per column (the git-remote posture), so no response, audit row or log can echo them. On writes the git-remote credential contract applies: an omitted field preserves the stored value, a supplied empty string clears it. A credentialed write on a server with no encryption keys configured answers the typed unavailable + ERROR_REASON_SERVER_NOT_CONFIGURED with the detail git credentials cannot be stored: no encryption keys are configured on this server (the contract).

Scoping and authorization

A credential lives at a node and is a capability — project scoping keeps one team's PAT from powering another team's remotes:

• Project scope (project_code set): procedures gate on the project's …/git_credentials rule path — read for reads, update for create/update/test, delete for delete — 404-on-deny, the git-remotes posture.
• Global scope (project_code unset): procedures gate on the /admin updatable determination (permission_denied on deny, the connector posture).
• Reads within a project scope include the global credentials (a remote there may reference them); mutations always require the credential's own scope — a project never edits the global registry, nor the reverse.
• A git remote may only reference a credential at or above its own node: its project's, or a global one. A reference to another project's credential is refused (Credential ref must reference a shared credential at the Git remote's project or the global registry).

Procedures — GitCredentialService

Procedure	Behaviour
ListGitCredentials	The scope's referenceable credentials, name ascending, cursor-paginated: a project's own plus the global ones, or the global registry alone.
GetGitCredential	One credential by id, or by its unique name within the scope (a project row shadows a global one of the same name).
CreateGitCredential	Creates at the scope's node. https_basic requires a password; ssh_key requires key data; each kind refuses the other kind's fields (user may accompany either).
UpdateGitCredential	In-place update — resolve-at-use means every referencing remote picks the new values up on its next fetch/clone, with no write to any remote. The kind is fixed.
DeleteGitCredential	Refused while any git remote references it; the refusal names the referencing remotes (Git credential is in use by Git remotes (<project>/<remote>, …), it cannot be deleted.).
TestGitCredential	Probes the credential against a nominated remote URL (git ls-remote). The outcome rides the response: success, or a classified, credential-free failure_reason.
ExtractGitRemoteCredential	Migrates a remote's stored inline values into a new named credential at the remote's project and flips the remote to the reference — one transaction, values preserved, kind inferred from the remote's URL (SSH → ssh_key).

Audit events

Create/update/delete/test record api:git_credentials:create|update|destroy|test; the extract action records api:git_credentials:extract. Each credential-backed fetch/clone resolution additionally records a git_credentials:use event scoped to the remote's project, naming the credential and remote (never a value).

From the CLI

opschain git-credentials list|create|update|test|delete manages the registry (--project <code> for a project's scope, omitted for the global one; a credential addressed by id or name), and opschain git-remotes create/update --credential-ref <id|name> points a remote at an entry — see opschain docs cli/git-credentials.

Related pages

• opschain docs cli/git-credentials — the CLI family over this service.
• opschain docs resources/git_remote — the credential_ref reference and the refuse-both write contract.
• opschain docs api-v2 — the service census.