git-credential-githosted

git-credential-githosted is a small standalone Git credential helper for githosted. If you want git clone https://githosted.dev/... to Just Work but you don’t need the full gho CLI, install just this binary and configure git to use it.

This is the analog of Microsoft’s Git Credential Manager for GitHub: a single small binary that integrates with Git’s credential-helper subsystem and handles the OAuth flow for one host. Same binary that gho ships internally; narrower install.

When to install this vs gho

You want	Install
Just git clone to work without ever pasting a token	git-credential-githosted
Everything above, plus gho repos, gho cat, gho clone, gho tokens, etc.	gho (which also includes the credential helper)

The two binaries are wire-compatible: a token minted via git-credential-githosted is reusable by gho if you install it later, and vice versa. Both store in the same OS keychain entry, keyed on the API host.

Install

macOS / Linux

curl -fsSL https://githosted.sh | sh

(The default installer drops both gho and git-credential-githosted together, so you’ve already got the helper after running this.)

If you really only want the helper and not gho, after install you can sudo rm /usr/local/bin/gho.

Windows

irm https://githosted.sh/install.ps1 | iex

Drops the binaries in %LOCALAPPDATA%\gho\bin and adds that directory to your user PATH. Re-open the shell for the PATH change to take effect.

Windows users coming from gh auth login + GCM will find the flow identical: configure once, browser OAuth on first clone, silent forever after.

Want to read the script before running it? See Verify the install script on the gho page — same script.

Configure git

One-time setup; same key-format gho would write itself. Configure both hosts so clones via the apex (githosted.dev) and the underlying API origin (api.githosted.dev) both resolve:

git config --global \
    credential.https://githosted.dev.helper \
    git-credential-githosted
git config --global \
    credential.https://api.githosted.dev.helper \
    git-credential-githosted

Scoping the helper to those two hosts means it only fires for githosted. Your existing helper for github.com / gitlab.com / your corporate host stays untouched.

Use

git clone https://githosted.dev/myws/myrepo.git
# First time only:
#   First-time setup: opening browser to authorize this machine…
#   ✓ Authenticated.
# (browser confirms; clone proceeds)

Every subsequent git operation against either host is silent — the helper reads the OS keychain and answers the credential prompt without your involvement.

Rotate / log out

# Trigger Git's credential-helper erase to clear the cached token.
git credential reject <<EOF
protocol=https
host=githosted.dev

EOF

# Or just delete the credential helper config and the keychain
# entry — same effect.
git config --global --unset credential.https://githosted.dev.helper
git config --global --unset credential.https://api.githosted.dev.helper

The token is server-revocable too: open the Tokens page in the dashboard and click Revoke on the entry named oauth-ghc_….

Operations (called by Git)

The helper implements the standard gitcredentials protocol — Git invokes the binary with get / store / erase, piping a key=value block on stdin terminated by an empty line.

Operation	Behavior
get	Read the cached token; if missing, run the OAuth flow inline (loopback redirect → device-flow fallback). Output username=oauth\npassword=<token>.
store	No-op. The helper persists via the OAuth flow on get, not via Git’s prompt.
erase	Delete the cached token for the requested host.

Configuration

Knob	Default	Notes
GITHOSTED_API_URL	https://api.githosted.dev	Override for self-hosted or dev stacks. The helper only handles the configured host.
Token storage	OS keychain	Same backend as the full CLI — one entry per host.

Same OAuth flow as gho

The helper runs the same OAuth 2.1 authorization-code + PKCE flow gho auth login uses, with the same loopback-redirect default and device-flow fallback. The first git clone is the trigger — there’s no separate “log in” step.

Status

v0 — covers the credential-helper protocol surface. Tracks the gho CLI version; both binaries ship from the same release.