remote: Invalid username or token. Password authentication is not supported for Git operations.

[suzuki-shunsuke]

ghtkn info

$ ghtkn -v
ghtkn version 0.2.2

Overview

Git Credential Helper fails when the user access token has expired.
But if we run the command immediately again, the command succeeds.

How to reproduce

~/.gitconfig

[credential]
	helper = !ghtkn git-credential
	useHttpPath = true

Command:

Run git push or git pull.

git pull

Expected behaviour

Git Credential Helper works fine.

Actual behaviour

The command fails.

remote: Invalid username or token. Password authentication is not supported for Git operations.
fatal: Authentication failed for 'https://github.com/<redacted>/<redacted>/'

But if we run the same command immediately, the command succeeds.

The application uses the device flow to generate your GitHub User Access Token.
Copy your one-time code: <redacted>
This code is valid until 2025-11-17T09:55:14+09:00
https://github.com/login/device will open automatically after a few seconds...

Note

This is the problem of Git Credential Helper.
Maybe Git doesn't pass path to the credential helper for some reason.

ghtkn/pkg/cli/get/git_credential.go

Lines 19 to 66 in 2d0662b

	func (r *runner) readStdinForGitCredentialHelper(ctx context.Context) (*scanResult, error) { //nolint:cyclop
	inputCh := make(chan *scanResult, 1)
	go func() {
	scanner := bufio.NewScanner(r.stdin)
	result := &scanResult{}
	for scanner.Scan() {
	line := scanner.Text()
	if line == "" {
	break // empty line means the end of input
	}
	key, value, ok := strings.Cut(line, "=")
	if !ok {
	continue // ignore invalid stdin
	}
	switch key {
	case "protocol":
	result.Protocol = value
	case "host":
	result.Host = value
	case "username":
	result.Username = value
	case "path":
	// path is used to switch GitHub Apps by repository
	// But path may not be passed.
	// To guarantee the path is passed, you can configure Git like below:
	//
	// $ git config credential.useHttpPath true
	result.Path = value
	result.Owner = strings.Split(value, "/")[0]
	case "password":
	result.Password = value
	default:
	continue // ignore unknown keys
	}
	}
	result.Err = scanner.Err()
	inputCh <- result
	close(inputCh)
	}()
	select {
	case <-ctx.Done():
	return nil, ctx.Err() //nolint:wrapcheck
	case result := <-inputCh:
	return result, result.Err
	}
	}

[suzuki-shunsuke]

Output the debug log

[credential]
	helper = !~/go/bin/ghtkn git-credential --log-level debug
	useHttpPath = true

❌

Nov 17 11:01:49.373 DBG running in Git Credential Helper mode program=ghtkn version=v3.0.0-local arg=erase
Nov 17 11:01:49.373 DBG selecting app program=ghtkn version=v3.0.0-local app_name=<redacted> git_owner=""

⭕

Nov 17 11:03:56.014 DBG running in Git Credential Helper mode program=ghtkn version=v3.0.0-local arg=get
Nov 17 11:03:56.015 DBG read a parameter from stdin for Git Credential Helper program=ghtkn version=v3.0.0-local protocol=https
Nov 17 11:03:56.015 DBG read a parameter from stdin for Git Credential Helper program=ghtkn version=v3.0.0-local host=github.com
Nov 17 11:03:56.015 DBG read a parameter from stdin for Git Credential Helper program=ghtkn version=v3.0.0-local path=<redacted>/<redacted>
Nov 17 11:03:56.015 DBG selecting app program=ghtkn version=v3.0.0-local app_name=<redacted> git_owner=<redacted>

ghtkn/pkg/cli/get/git_credential.go

Lines 24 to 96 in 3e6c637

	func (r *runner) handleGitCredential(ctx context.Context, logger *slog.Logger, arg string, input *get.Input, inputGet *ghtkn.InputGet) error {
	logger.Debug("running in Git Credential Helper mode", "arg", arg)
	input.IsGitCredential = true
	if arg != "get" {
	return nil
	}
	result, err := r.readStdinForGitCredentialHelper(ctx)
	if err != nil {
	return fmt.Errorf("read stdin: %w", err)
	}
	if result.Owner == "" {
	logger.Warn("failed to get the repository owner from stdin for Git Credential Helper")
	}
	inputGet.AppOwner = result.Owner
	return nil
	}
	func (r *runner) readStdinForGitCredentialHelper(ctx context.Context) (*scanResult, error) { //nolint:cyclop
	inputCh := make(chan *scanResult, 1)
	go func() {
	scanner := bufio.NewScanner(r.stdin)
	result := &scanResult{}
	for scanner.Scan() {
	line := scanner.Text()
	if line == "" {
	break // empty line means the end of input
	}
	key, value, ok := strings.Cut(line, "=")
	if !ok {
	continue // ignore invalid stdin
	}
	if key != "password" {
	r.logger.Debug("read a parameter from stdin for Git Credential Helper", key, value)
	}
	switch key {
	case "protocol":
	result.Protocol = value
	case "host":
	result.Host = value
	case "username":
	result.Username = value
	case "path":
	// path is used to switch GitHub Apps by repository
	// But path may not be passed.
	// To guarantee the path is passed, you can configure Git like below:
	//
	// $ git config credential.useHttpPath true
	a, _, ok := strings.Cut(value, "/")
	if !ok {
	r.logger.Warn("the path from stdin for Git Credential Helper is unexpected", "path", value)
	continue
	}
	result.Path = value
	result.Owner = a
	case "password":
	result.Password = value
	default:
	continue // ignore unknown keys
	}
	}
	result.Err = scanner.Err()
	inputCh <- result
	close(inputCh)
	}()
	select {
	case <-ctx.Done():
	return nil, ctx.Err() //nolint:wrapcheck
	case result := <-inputCh:
	return result, result.Err
	}
	}

[suzuki-shunsuke]

Seems like this isn't a bug, but if Git Credential Helper is enabled but stdin is not passed, ghtkn should suggests the guide to users.

• docs: update the document about Git Credential Helper #166
• https://github.com/suzuki-shunsuke/ghtkn?tab=readme-ov-file#git-credential-helper