Credential FAQ

🚀Credential FAQ

Support Guide

Clarify what Custy stores, when fallback activates, and what remains owned by Git.

Commandcusty configure credentials

📦Category

Configuration

🚀Quick Command

custy configure credentials [COMMAND]

---

Does Custy replace Git Credential Manager?

No. Native Git helpers run first. With the recommended container-only boundary, local execution never activates Custy's managed fallback.

Does Custy store my PAT in config.toml?

No. TOML stores policy and source metadata only. The PAT remains in an external protected file or runtime environment variable.

Why does Git still ask for a username and password?

No usable token source was available, the remote was not eligible, or native Git did not authenticate. An interactive prompt remains an intentional final option when interactive_fallback = true. For an HTTPS remote, enter the provider username and a PAT when Git says Password; do not enter the account password.

What does the credential bind mount mean?

-v "%LOCALAPPDATA%\Custy\credentials:/run/secrets/custy" maps the persistent Windows directory on the left to the container directory on the right. For example, %LOCALAPPDATA%\Custy\credentials\github.token and /run/secrets/custy/github.token are the same mounted file during that container run.

Why did a token disappear after the container exited?

Without the credential bind mount, file mode writes /run/secrets/custy/github.token only into the disposable container filesystem. --rm removes that filesystem at exit. Mount an external host directory while running set, and mount the same directory whenever status, test, or push needs the token.

Why is the provider enabled while its token file is missing?

Enabled reports persistent policy from the project’s .config/custy/config.toml. Token file reports whether the current process can access and validate the configured external file. A container can therefore show yes and missing when the project configuration is mounted but the credential directory is not.

Why is Environment missing when the token file is valid?

File and environment are alternative sources. Environment: missing only means the named variable, such as CUSTY_GITHUB_TOKEN, was not passed to this process. A valid higher-priority token file is sufficient.

Why does file setup require docker run -it?

-i keeps input open and -t allocates a terminal that can hide the PAT safely. Custy rejects a non-interactive hidden-token prompt instead of allowing Python to echo the secret. Environment-backed setup does not prompt for a token value.

Does the manual prompt save my credentials?

No. Run Docker with -it, omit the managed token source, and answer Git’s username and PAT prompts. A disposable --rm container normally asks again on its next run and may ask separately for each provider. Use a protected file, environment variable, native credential helper, or SSH to avoid repetitive entry.

Which username should I use?

Generated managed-fallback defaults are x-access-token for GitHub and oauth2 for GitLab. During a native manual prompt, the account username is also accepted when the provider permits it. The username is not treated as secret; the PAT supplied as the HTTPS password is secret.

Does Custy support SSH?

Custy supports projects whose Git remotes use SSH, but authentication remains entirely native. Custy does not create, store, copy, or mount SSH private keys.

Can dry-run test my token?

No. The dry-run contract intentionally prevents credential reads and remote contact. Run the normal read-only test command when network verification is approved.

Does remove delete my file?

Not by default. remove disables the provider and preserves the external file. Add --delete-file for explicit deletion.