gitprofile

Manage multiple git identities — work, personal, open-source — so the right name, email, and SSH key are always used without thinking about it.

The problem it solves

If you only have one GitHub account, git just works. But the moment you have two — a work account and a personal one — things get quietly broken in ways that are hard to notice.

You push a commit from your work laptop and it shows up under your personal email. Or you try to push to a company repo and get Permission denied (publickey). Or you've been signing commits for months and only realize the wrong key was used when someone audits the history.

The root cause is two separate problems that git and SSH don't solve for you automatically:

Identity — user.name, user.email, and the commit signing key. Per-repo git config is tedious and easy to forget.
SSH key routing — which private key SSH uses for a given host. If you have multiple keys, SSH may grab the wrong one from your agent. Adding IdentitiesOnly yes to ~/.ssh/config helps, but configuring it per-host breaks down when both accounts are on github.com.

gitprofile solves both, permanently, for all repos in a directory — without touching ~/.ssh/config or rewriting remote URLs.

How it works

gitprofile uses git's built-in includeIf directive. When you add a profile, it writes a small block to your ~/.gitconfig:

# >>> gitprofile managed >>>
[includeIf "gitdir:~/work/"]
    path = ~/.config/gitprofile/profiles/work.gitconfig
[includeIf "gitdir:~/personal/"]
    path = ~/.config/gitprofile/profiles/personal.gitconfig
# <<< gitprofile managed <<<

Each profile file holds the full identity and SSH config for that account:

# ~/.config/gitprofile/profiles/work.gitconfig
[user]
    name = Jane Dev
    email = jane@company.com
    signingkey = ~/.ssh/id_work.pub
[core]
    sshCommand = "ssh -i ~/.ssh/id_work -o IdentitiesOnly=yes"
[commit]
    gpgsign = true
[gpg]
    format = ssh

Git loads this file automatically for any repo under ~/work/. No per-repo setup, no environment variables, no aliases — it just works because git itself is doing the routing.

The IdentitiesOnly=yes in sshCommand is the key detail: it tells SSH to only try the key you specified and ignore everything in the agent. This is what prevents the "authenticated as wrong account" failure mode that trips up most manual setups.

Installation

Homebrew (macOS / Linux)

brew install meanii/gitprofile/gitprofile

go install

go install github.com/meanii/gitprofile@latest

APT (Debian / Ubuntu)

curl -LO https://github.com/meanii/gitprofile/releases/latest/download/gitprofile_linux_amd64.deb
sudo dpkg -i gitprofile_linux_amd64.deb

Pacman (Arch Linux)

curl -LO https://github.com/meanii/gitprofile/releases/latest/download/gitprofile_linux_amd64.pkg.tar.zst
sudo pacman -U gitprofile_linux_amd64.pkg.tar.zst

Build from source

Requires Go 1.21+.

git clone https://github.com/meanii/gitprofile.git
cd gitprofile
go build -o gitprofile .
mv gitprofile /usr/local/bin/

Shell completion

# bash
gitprofile completion bash > /etc/bash_completion.d/gitprofile

# zsh
gitprofile completion zsh > "${fpath[1]}/_gitprofile"

# fish
gitprofile completion fish > ~/.config/fish/completions/gitprofile.fish

Getting started

Here's a real-world setup from scratch: a work account on GitHub and a personal one on the same host.

1. Create your work profile

$ gitprofile add work
Full Name: Jane Dev
Email: jane@company.com
Host (github.com / gitlab.com / bitbucket.org): github.com
Generate new SSH key? (y/n) [y]: y
  Generated ~/.ssh/id_work
  Public key (add this to https://github.com/settings/ssh/new):
  ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA...
Enable SSH commit signing? (y/n) [y]: y
Directories this profile owns? (comma-separated, blank = none): ~/work

Profile "work" created — active for repos under: ~/work

Copy the public key and add it to GitHub. Do this for both authentication and signing (GitHub calls them "Authentication keys" and "Signing keys" separately).

2. Create your personal profile

$ gitprofile add personal
Full Name: Jane
Email: jane@personal.dev
Host (github.com / gitlab.com / bitbucket.org): github.com
Generate new SSH key? (y/n) [y]: y
  Generated ~/.ssh/id_personal
  Public key (add this to https://github.com/settings/ssh/new):
  ssh-ed25519 AAAAC3NzaC1lZDI1NTE5BBBB...
Enable SSH commit signing? (y/n) [y]: y
Directories this profile owns? (comma-separated, blank = none): ~/personal

Profile "personal" created — active for repos under: ~/personal

3. Verify the setup

$ gitprofile list
* work:     Jane Dev <jane@company.com>    (dirs: [~/work])
  personal: Jane     <jane@personal.dev>  (dirs: [~/personal])

The * marks which profile is active in your current directory.

4. Test it

$ cd ~/work
$ gitprofile doctor
── profile: work ──
[OK]   SSH key ~/.ssh/id_work
[OK]   gitconfig fragment
       Testing SSH auth → github.com ...
[OK]   SSH auth
       Hi jane-work! You've successfully authenticated...
[OK]   allowed_signers entry

[OK] All checks passed.

If you see Permission denied from the SSH test, the public key isn't added to GitHub yet — the doctor output will show you the URL to open.

Use cases

Repos in a watched directory (automatic)

This is the normal path. Once a profile owns a directory, every repo inside it inherits the right identity and key with zero effort.

mkdir -p ~/work
cd ~/work
git clone git@github.com:company/api.git  # uses work SSH key automatically
cd api
git commit -m "fix: handle null case"     # commits as jane@company.com
git push                                   # authenticates as your work account

No extra steps. Git picks up the profile because of the includeIf rule.

Cloning a repo with the right key

When you clone, the repo doesn't exist yet so includeIf can't fire. Use gitprofile clone instead — it sets GIT_SSH_COMMAND for that one command and drops the repo into the right directory:

gitprofile clone git@github.com:company/new-service.git --as work
# Clones into ~/work/new-service with the work SSH key
# Future git operations in that repo use the work profile automatically

Or just run it from inside the watched directory and it auto-detects:

cd ~/work
gitprofile clone git@github.com:company/new-service.git
# Using profile "work" (matched current directory)

A repo outside any watched directory

You cloned something into /tmp or got handed a repo that lives outside your normal folders. Use gitprofile use to apply a profile just for that repo:

cd /tmp/client-hotfix
gitprofile use work
# Profile applied locally to this repo.

git log --oneline -1
# abc1234 fix: payment timeout — Jane Dev <jane@company.com>

This writes the identity and SSH config into the repo's .git/config so it only affects that one repo and doesn't touch anything else.

A default identity for everything else (--global)

You mostly use one account and only occasionally work on things that need a different one. Set a global catch-all:

gitprofile add personal --global

This adds an unconditional [include] to your ~/.gitconfig that loads the personal profile everywhere. Directory-specific profiles still override it — the global one is just the fallback for anything that doesn't match.

gitprofile list
  work:     Jane Dev <jane@company.com>   (dirs: [~/work])
* personal: Jane     <jane@personal.dev> (global)

Checking what's active

Run gitprofile current from anywhere to see exactly which profile applies and why:

# Inside a watched directory
$ cd ~/work/api
$ gitprofile current
Profile: work (Jane Dev <jane@company.com>)
Reason: in directory ~/work (owned by profile)

# Inside a repo with a local override
$ cd /tmp/client-hotfix
$ gitprofile current
Profile: work (Jane Dev <jane@company.com>)
Reason: local override in .git/config

# Somewhere with no match and no global
$ cd /tmp/random
$ gitprofile current
No profile matches this directory. Use 'gitprofile use <name>' for a local override.

Contributing to open source

You have a personal GitHub account but want to contribute to open source under that identity from wherever the repos happen to live. Either:

Add ~/opensource to your personal profile's dirs, and always clone there
Or set personal as --global and override with gitprofile use work inside work repos

gitprofile clone git@github.com:some-org/cool-project.git --as personal
cd ~/personal/cool-project
git commit -m "feat: add dark mode support"
# Commits as jane@personal.dev, signed with your personal key

Quick identity check before committing

You're about to push and want to confirm you're using the right account:

$ gitprofile whoami
Jane Dev <jane@company.com>
Signing key: /Users/jane/.ssh/id_work.pub

One command, no arguments, no flags. Shows exactly what git will put in the commit.

Dotfiles — take your profiles to a new machine

Export your profiles and commit them to your dotfiles repo:

gitprofile export ~/dotfiles/gitprofile.yaml
git -C ~/dotfiles commit -am "update gitprofile config"

On a new machine, after copying your SSH keys over:

gitprofile import ~/dotfiles/gitprofile.yaml
# Imported 3 profiles.
# Warning: SSH key not found at ~/.ssh/id_work — copy it to this machine before using profile "work"

The import restores all profile metadata and wires up ~/.gitconfig. You just need the actual key files present.

Start of day — load keys into the agent

If you use a passphrase on your keys (you should), load them into the agent once at login:

gitprofile agent add work --ttl 8h
gitprofile agent add personal --ttl 8h

The keys expire automatically after 8 hours so you're not leaving them loaded overnight.

Multiple git hosts

If you use GitHub for work and GitLab for personal, or have a self-hosted Bitbucket, each profile just carries a different host:

gitprofile add gitlab-personal
# Host: gitlab.com
# ...

gitprofile add self-hosted
# Host: git.mycompany.internal
# ...

The sshCommand in each profile is scoped to that profile's key, so there's no conflict even if both hosts are on the same machine.

All commands

`gitprofile add <name>`

Creates a new profile. Walks you through name, email, host, SSH key (generate new or point at existing), commit signing, and which directories it owns.

gitprofile add work
gitprofile add personal --global   # catch-all default, no directory needed

After running this, add the printed public key to your git host. The output includes the exact URL.

`gitprofile list`

Shows all profiles. The * marks whichever one is active in your current directory.

$ gitprofile list
* work:     Jane Dev <jane@company.com>   (dirs: [~/work ~/company])
  personal: Jane     <jane@personal.dev> (global)
  oss:      J        <j@oss.dev>         (dirs: [~/oss])

`gitprofile current`

Tells you which profile is active right now and why. Useful when something feels off or you're not sure which identity a repo is using.

$ gitprofile current
Profile: work (Jane Dev <jane@company.com>)
Reason: in directory ~/work (owned by profile)

`gitprofile use <name>`

Applies a profile as a local override inside the current repo's .git/config. Only affects that one repo. Use this for repos that live outside any owned directory.

cd /some/random/repo
gitprofile use personal

`gitprofile clone <url> [--as <name>]`

Clones with the right SSH key from the first byte. Without --as, auto-detects the profile from the current directory.

gitprofile clone git@github.com:company/service.git --as work
# Clones into ~/work/service (profile's first owned dir)

cd ~/personal
gitprofile clone git@github.com:you/side-project.git
# Auto-detects personal profile from the current directory

`gitprofile key show <name>`

Prints the public key to paste into GitHub / GitLab / Bitbucket.

$ gitprofile key show work
Public key for work:
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA...

`gitprofile key path <name>`

Prints the key file paths — useful when a tool asks for the key location.

$ gitprofile key path work
Private: /Users/jane/.ssh/id_work
Public:  /Users/jane/.ssh/id_work.pub

`gitprofile edit <name>`

Interactively update any field. Press Enter to keep the current value. Re-renders the gitconfig fragment and updates ~/.gitconfig when done.

gitprofile edit work
# Full Name [Jane Dev]:             ← press Enter to keep
# Email [jane@company.com]:         ← press Enter to keep
# SSH key [~/.ssh/id_work]:         ← press Enter to keep
# ...

`gitprofile remove <name>`

Removes the profile, its gitconfig fragment, and its includeIf entry from ~/.gitconfig. Asks whether to delete the SSH key files too (defaults to keeping them).

gitprofile remove work
# Delete SSH key files? (y/n) [n]: n
# Profile removed.

`gitprofile whoami`

Shows the git identity that applies right now — resolved exactly as git would for the current directory. Faster than running git config user.email manually, and shows everything at once.

$ cd ~/work/api
$ gitprofile whoami
Jane Dev <jane@company.com>
Signing key: /Users/jane/.ssh/id_work.pub

`gitprofile current`

Tells you which profile is active right now and why. Useful when something feels off or you're not sure which identity a repo is using.

$ gitprofile current
Profile: work (Jane Dev <jane@company.com>)
Reason: in directory ~/work (owned by profile)

Use --short to print only the profile name — handy for shell prompt integration:

$ gitprofile current --short
work

Starship prompt (~/.config/starship.toml):

[custom.gitprofile]
command = "gitprofile current --short"
when = "gitprofile current --short"
symbol = " "
style = "bold blue"

Zsh PS1:

PS1='$(gitprofile current --short 2>/dev/null | sed "s/.*/ [&]/") %~ $ '

`gitprofile rename <old-name> <new-name>`

Renames a profile cleanly — updates the config, renames the fragment file, and rewrites the managed block in ~/.gitconfig.

gitprofile rename work main-work
# Renamed "work" → "main-work".
# Note: SSH key ~/.ssh/id_work was not moved — update it with 'gitprofile edit main-work' if needed.

`gitprofile copy <source> <dest>`

Duplicates a profile as a starting point. Copies identity fields (name, email, host, signing preference) and offers to generate a fresh SSH key. Directories are cleared so the two profiles don't conflict — set them with gitprofile edit <dest> afterwards.

gitprofile copy work work-client
# Generate new SSH key at ~/.ssh/id_work-client? (n = reuse ~/.ssh/id_work) [y]:
# Generated ~/.ssh/id_work-client
# Profile "work-client" created from "work".
# Set its directories with: gitprofile edit work-client

`gitprofile export [file]`

Writes all profiles to a portable YAML file (or stdout if no file is given). Key file paths are recorded but key contents are not — safe to commit to a dotfiles repo.

gitprofile export ~/dotfiles/gitprofile.yaml
# Exported 3 profile(s) to ~/dotfiles/gitprofile.yaml

`gitprofile import <file>`

Reads a file produced by gitprofile export and merges the profiles into the local config. SSH key files must already be present on the machine.

gitprofile import ~/dotfiles/gitprofile.yaml
# Imported 3 profiles.

gitprofile import ~/dotfiles/gitprofile.yaml --overwrite
# Replaces existing profiles that share a name.

`gitprofile agent add <name>`

Adds a profile's SSH key to the running SSH agent. Useful at the start of a work session. Use --ttl to set an expiry so the key unloads automatically.

gitprofile agent add work
gitprofile agent add work --ttl 8h   # expires after 8 hours

gitprofile agent list    # show keys currently in the agent
gitprofile agent remove work   # remove a profile's key from the agent

`gitprofile hook install`

Installs a post-checkout hook that warns whenever you switch into a repo that has no active profile. Install once globally and it covers every repo on the machine.

gitprofile hook install --global
# Hook installed at ~/.config/gitprofile/hooks/post-checkout
# core.hooksPath → ~/.config/gitprofile/hooks (set in ~/.gitconfig)
# Every repo you check out will now warn if no gitprofile matches.

Or install it only for the current repo:

gitprofile hook install

Remove with gitprofile hook remove (or --global).

`gitprofile doctor`

Runs a full health check. Catches the problems that silently break things:

SSH key missing, wrong permissions, or not parseable
gitconfig fragment missing or out of date
Public key not registered in allowed_signers (for signing profiles)
Live SSH connectivity test against each profile's host
Two profiles claiming the same directory
Managed block missing from ~/.gitconfig

$ gitprofile doctor

── profile: work ──
[OK]   SSH key ~/.ssh/id_work
[OK]   gitconfig fragment
[OK]   allowed_signers entry
       Testing SSH auth → github.com ...
[OK]   SSH auth
       Hi jane-work! You've successfully authenticated...

── profile: personal ──
[OK]   SSH key ~/.ssh/id_personal
[OK]   gitconfig fragment
[WARN] public key not in allowed_signers (~/.ssh/allowed_signers)

[OK]   managed block present in ~/.gitconfig

1 problem(s) found. Run 'gitprofile doctor --fix' to auto-repair what's possible.

Add --fix to automatically repair what it can — wrong key permissions, missing fragment files, missing allowed_signers entries, and a missing managed block:

gitprofile doctor --fix

Run doctor after any setup change, or whenever a push fails and you're not sure why.

Files it creates

Path	What it is
`~/.config/gitprofile/config.yaml`	The list of all your profiles
`~/.config/gitprofile/profiles/<name>.gitconfig`	Per-profile gitconfig fragment included by git
`~/.gitconfig`	Has the managed `includeIf` block appended
`~/.gitconfig.gitprofile.bak`	Backup of your gitconfig before each edit
`~/.ssh/id_<name>`	Generated ed25519 private key (permissions: 0600)
`~/.ssh/id_<name>.pub`	Generated ed25519 public key (permissions: 0644)
`~/.ssh/allowed_signers`	Used by git to verify signed commits locally

gitprofile never touches anything outside these paths.

Safety

Your existing gitconfig is safe. All changes live inside a clearly-marked >>> gitprofile managed >>> block. The tool only reads and rewrites that block — everything else in your ~/.gitconfig is untouched.

A backup is written before every change. ~/.gitconfig.gitprofile.bak is created before any modification so you can restore it if something goes wrong.

Keys are never overwritten. If ~/.ssh/id_work already exists, add will ask if you want to reuse it. It won't silently clobber it.

IdentitiesOnly=yes is always set. Every profile's sshCommand includes this flag. It prevents SSH from offering other keys from the agent and accidentally authenticating as the wrong account.

Private key permissions are enforced. Keys are created as 0600. If you point at an existing key, gitprofile will fix its permissions if they're too open.

Development

go test ./...                  # run all tests
go build -buildvcs=false .     # build binary
just test                      # same via justfile
just check                     # fmt + vet + staticcheck

Tests cover config round-trips, gitconfig fragment rendering, managed-block rewriting, SSH key generation and validation, allowed_signers management, and hosts connectivity helpers.

License

MIT

Name		Name	Last commit message	Last commit date
Latest commit History 9 Commits
.github/workflows		.github/workflows
cmd		cmd
internal		internal
.gitignore		.gitignore
.goreleaser.yaml		.goreleaser.yaml
LICENSE		LICENSE
README.md		README.md
demo.gif		demo.gif
demo.tape		demo.tape
go.mod		go.mod
go.sum		go.sum
justfile		justfile
main.go		main.go
test-integration.sh		test-integration.sh

Folders and files

Latest commit

History

Repository files navigation

gitprofile

The problem it solves

How it works

Installation

Homebrew (macOS / Linux)

go install

APT (Debian / Ubuntu)

Pacman (Arch Linux)

Build from source

Shell completion

Getting started

1. Create your work profile

2. Create your personal profile

3. Verify the setup

4. Test it

Use cases

Repos in a watched directory (automatic)

Cloning a repo with the right key

A repo outside any watched directory

A default identity for everything else (--global)

Checking what's active

Contributing to open source

Quick identity check before committing

Dotfiles — take your profiles to a new machine

Start of day — load keys into the agent

Multiple git hosts

All commands

gitprofile add <name>

gitprofile list

gitprofile current

gitprofile use <name>

gitprofile clone <url> [--as <name>]

gitprofile key show <name>

gitprofile key path <name>

gitprofile edit <name>

gitprofile remove <name>

gitprofile whoami

gitprofile current

gitprofile rename <old-name> <new-name>

gitprofile copy <source> <dest>

gitprofile export [file]

gitprofile import <file>

gitprofile agent add <name>

gitprofile hook install

gitprofile doctor

Files it creates

Safety

Development

License

About

Resources

License

Uh oh!

Stars

Watchers

Forks

Releases 3

Packages 0

Uh oh!

Contributors

Uh oh!

Languages

`gitprofile add <name>`

`gitprofile list`

`gitprofile current`

`gitprofile use <name>`

`gitprofile clone <url> [--as <name>]`

`gitprofile key show <name>`

`gitprofile key path <name>`

`gitprofile edit <name>`

`gitprofile remove <name>`

`gitprofile whoami`

`gitprofile current`

`gitprofile rename <old-name> <new-name>`

`gitprofile copy <source> <dest>`

`gitprofile export [file]`

`gitprofile import <file>`

`gitprofile agent add <name>`

`gitprofile hook install`

`gitprofile doctor`

Packages