Git Credentials let you deploy My Apps from private GitHub, GitLab, or Gitea repositories without ever sharing your Personal Access Token (PAT) in chat or MCP arguments. You register the PAT once under a friendly name; OSC stores it securely, and you reference it by name thereafter.

When you deploy from a private repository, OSC needs your PAT to clone the code. Without git credentials, you would paste the raw token into an MCP tool argument or the web form — where it appears in chat history, MCP audit logs, and browser memory. Git credentials avoid this:

• The PAT is entered in your browser (or via a terminal command you run yourself) and stored encrypted server-side.
• Only the friendly name (e.g. "my-github-token") appears in MCP conversations and deployment records.
• Token rotation replaces the stored value without changing the name — running apps continue to reference the same credential key.

• An OSC account on any plan
• A Personal Access Token from GitHub, GitLab, or Gitea with at least read access to the target repository

You can register a credential in three ways. All three store the PAT under the same user.gitcred.<name> key.

1. Go to My Apps in the OSC web console.
2. Click the Git Credentials tab.
3. Click Add credential.
4. Choose Paste a PAT and enter a name and your token, or choose Use GitHub account if you have a connected GitHub account.
5. Click Save credential.

Ask your AI assistant (via MCP) to start the registration flow:

Register a git credential called "my-github-token" for my private repository.

The start-git-credential-registration tool returns a one-time URL valid for 10 minutes:

1. Open the URL in your browser.
2. Log in with your OSC account if prompted.
3. Paste your PAT in the form and submit.

The PAT travels directly from your browser to OSC — it never passes through MCP, your AI assistant, or any chat log.

Ask the AI assistant for curl instructions:

Give me the curl command to register a git credential called "ci-github-token".

The get-git-credential-setup-instructions tool returns a ready-to-run command:

curl -X PUT "https://deploy.svc.prod.osaas.io/mytenantsecrets/user.gitcred.ci-github-token" \
  -H "x-pat-jwt: Bearer $OSC_PAT_JWT" \
  -H "Content-Type: application/json" \
  -d '{"value":"YOUR_GITHUB_PAT_HERE"}'

Run this command in your own terminal. Replace YOUR_GITHUB_PAT_HERE with your actual PAT and set $OSC_PAT_JWT to your OSC Personal Access Token (from API Access, see Finding Your API Token). Do not paste the command back into AI chat.

Pass the credential name in create-my-app:

Create a My App called "myapp" from the private repo https://github.com/myorg/private-repo
using the git credential "my-github-token".

The create-my-app tool accepts a gitCredential parameter. The raw PAT never appears in the tool call.

When creating a My App from a private repository, the Git Token (Optional) field in the Create App form offers two modes:

• Paste token — type or paste a Personal Access Token directly into the field; it is stored as a Kubernetes secret for that app.
• Use saved credential — select a credential you have already registered under My Apps → Git Credentials. The dropdown is populated from your saved credentials automatically.

Choose Use saved credential to avoid handling the raw token during app creation: the credential reference is stored instead of the token value itself.

When a PAT expires, rotate without downtime:

1. Register a new PAT under the same friendly name (overwrite it via the web console, MCP browser flow, or curl).
2. Trigger a token update via MCP:

Update the git token for my app "myapp" to use the credential "my-github-token".

The update-my-app-github-token tool applies a rolling restart — the app stays at the same URL with no downtime.

Or update via MCP in one step:

Rotate the git credential for "myapp" to use "my-github-token" (already updated in OSC).

List my git credentials.

The list-git-credentials MCP tool returns all friendly names with creation and last-updated timestamps, plus which My Apps and Agent Tasks are currently bound to each credential (boundApps, boundAgentTasks). Credential values (PATs) are never returned.

Each credential also includes an age in days and an expiry risk rating:

When the AI assistant lists your credentials and an expiry risk warning is shown, reissue the PAT on GitHub (Settings → Developer settings → Fine-grained personal access tokens) and re-register it using update-my-app-github-token or the browser flow.

You can also view credentials on the Git Credentials tab in My Apps.

The list-my-apps MCP tool likewise shows which git credential is linked to each app (Git Credential field). Apps created with a raw inline token instead of a named credential show no Git Credential field.

If an app fails to build with a 403, Authentication failed, Permission denied, or No such device or address error on git clone, the AI assistant automatically detects this pattern in diagnose-my-app and get-my-app-logs and guides you through the fix.

The No such device or address error is a TTY-style failure that git emits in containerised builds when a credential helper has no terminal to prompt on — it means the PAT is expired or missing, not that the repository URL is wrong.

GitHub fine-grained PATs have a 30-day default lifetime. If the error appears approximately 30 days after the credential was registered, the PAT has almost certainly expired — check the age via list-git-credentials before assuming a permission or URL problem.

1. Call list-git-credentials — check whether a credential is already registered and inspect its age. A HIGH expiry risk or a credential registered ~30 days ago is the most likely cause.
2. If the credential is expired — reissue the PAT on GitHub, then re-register it with start-git-credential-registration (browser flow) or the curl command from get-git-credential-setup-instructions. Then call update-my-app-github-token to link the refreshed token.
3. If no credential exists — use start-git-credential-registration to register one via the browser flow (see Register a Git Credential above), then call update-my-app-github-token to link it.
4. If a credential exists, is not expired, but is not linked — call update-my-app-github-token with the app name and the credential name.
5. The app automatically rebuilds after the token update. Call wait-for-app-ready to confirm the build succeeds.

This guidance applies to GitHub, GitLab, Bitbucket, and any non-OSC git host. Managed OSC Gitea repositories use a different credential path.

If you do not have GitHub or another git host, setup-git-repo creates a repository for your app on a private Gitea instance that OSC runs for your workspace. The repository starts empty, and you push your code to it before running create-my-app.

The response contains the clone URL, the web URL, and push instructions. The push instructions no longer contain the access token itself. Instead they show a <GITEA_PUSH_TOKEN> placeholder, and the response includes a one-time download link for the real token:

• The link is valid for 60 minutes.
• It can be used for up to 3 downloads.
• After it expires or is used up, call setup-git-repo again with the same app name to get a new link.

Download the token from the link and substitute it for <GITEA_PUSH_TOKEN> in the push commands. This keeps the token out of the chat history and MCP logs.

The token is the Gitea admin token for your whole workspace Gitea instance. It is not limited to one repository, so treat it like a password and do not share it.

If a download link cannot be created, setup-git-repo leaves out the push instructions rather than showing the token. In that case use commit-files-to-repo (see below) to add your files.

Instead of downloading the token each time, register a named git credential once and reuse it:

1. Call start-git-credential-registration and register the Gitea token under a name of your choice (see Register a Git Credential).
2. Pass that name as gitCredential in create-my-app for each app you deploy from the managed repository.

commit-files-to-repo writes files straight to the managed repository, so you do not need a local git client or the push token at all. This works well when an AI assistant writes the code for you.

The gitToken and gitHubToken parameters on create-my-app and update-my-app-github-token are deprecated. They still work for now, and removal is planned in a later phase. Migrate to gitCredential to keep PATs out of MCP arguments.

• My Apps dashboard
• Feature: My Agent Tasks — for deploying apps via AI agent
• User Guide: Credentials and Secrets — overview of all OSC credential types