{"record":{"id":"ecbce39de123c2e3","repo":"git-ecosystem/git-credential-manager","slug":"can-only-use-the-storenames-dpapi-credential-s","errorCode":null,"errorMessage":"Can only use the '{StoreNames.Dpapi}' credential store on Windows.\nSee {Constants.HelpUrls.GcmCredentialStores} for more information.","messagePattern":"Can only use the '(.+?)' credential store on Windows\\.\nSee (.+?) for more information\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/Core/CredentialStore.cs","lineNumber":224,"sourceCode":"            }\n\n            if (!WindowsCredentialManager.CanPersist())\n            {\n                var message = $\"Unable to persist credentials with the '{StoreNames.WindowsCredentialManager}' credential store.\";\n                _context.Trace2.WriteError(message);\n                throw new Exception(message + Environment.NewLine +\n                    $\"See {Constants.HelpUrls.GcmCredentialStores} for more information.\"\n                );\n            }\n        }\n\n        private void ValidateDpapi(out string storeRoot)\n        {\n            if (!PlatformUtils.IsWindows())\n            {\n                var message = $\"Can only use the '{StoreNames.Dpapi}' credential store on Windows.\";\n                _context.Trace2.WriteError(message);\n                throw new Exception(message  + Environment.NewLine +\n                    $\"See {Constants.HelpUrls.GcmCredentialStores} for more information.\"\n                );\n            }\n\n            // Check for a redirected credential store location\n            if (!_context.Settings.TryGetSetting(\n                Constants.EnvironmentVariables.GcmDpapiStorePath,\n                Constants.GitConfiguration.Credential.SectionName,\n                Constants.GitConfiguration.Credential.DpapiStorePath,\n                out storeRoot))\n            {\n                // Use default store root at ~/.gcm/dpapi_store\n                storeRoot = Path.Combine(_context.FileSystem.UserDataDirectoryPath, \"dpapi_store\");\n            }\n        }\n\n        private void ValidateMacOSKeychain()\n        {","sourceCodeStart":206,"sourceCodeEnd":242,"githubUrl":"https://github.com/git-ecosystem/git-credential-manager/blob/e8ce762cd04b4100ae637b5fbf39ef9d0a96561e/src/Core/CredentialStore.cs#L206-L242","documentation":"ValidateDpapi enforces that the DPAPI-protected credential store is only used on Windows. When the configured store is dpapi but the current OS is not Windows, GCM logs the error and throws with a link to the credential-store docs. DPAPI relies on Windows-protected data APIs unavailable elsewhere.","triggerScenarios":"EnsureBackingStore resolves the configured store to dpapi and calls ValidateDpapi while PlatformUtils.IsWindows() is false — e.g. GCM_CREDENTIAL_STORE=dpapi or credential.credentialStore=dpapi on Linux/macOS.","commonSituations":"Copying a Windows machine's .gitconfig or GCM_CREDENTIAL_STORE export to WSL/macOS/Linux; shared dotfiles that pin dpapi; CI images on Linux reusing Windows developer config.","solutions":["Choose a platform-appropriate store: `git config --global credential.credentialStore keychain` (macOS) or `secretservice`/`gpg` (Linux).","Remove the dpapi setting from shared configs; scope it per-OS with conditional includes.","If you intend Windows behavior inside WSL, either run git from Windows or configure GCM for a Linux store in WSL.","Review the help URL in the error for supported stores per platform."],"exampleFix":"// before (macOS with Windows config)\n[credential]\n\tcredentialStore = dpapi\n\n// after\n[credential]\n\tcredentialStore = keychain","handlingStrategy":"validation","validationCode":"bool isWindows = RuntimeInformation.IsOSPlatform(OSPlatform.Windows);\nvar store = \"$(git config --global credential.credentialStore)\".Trim();\nif (!isWindows && (store == \"dpapi\" || store == \"wincredman\"))\n    throw new InvalidOperationException(\"dpapi is Windows-only; choose keychain (macOS) or secret-service/gpg (Linux)\");","typeGuard":null,"tryCatchPattern":"try\n{\n    credentialStore.Get(serviceName);\n}\ncatch (Exception ex) when (ex.Message.Contains(\"Can only use the 'dpapi'\"))\n{\n    // reconfigure to a store supported on this OS and retry\n}","preventionTips":["Scope dpapi/wincredman settings to Windows-only machines via conditional includes.","Sanitize synced dotfiles before applying on macOS/Linux.","Set GCM_CREDENTIAL_STORE per environment in provisioning scripts, not in shared exports.","Use separate configs for Windows and WSL."],"tags":["git","credential-store","dpapi","platform","configuration"],"backgroundTag":"unsupported-platform","analyzedSha":"e8ce762cd04b4100ae637b5fbf39ef9d0a96561e","analyzedAt":"2026-09-11T17:15:08.753Z","contentChangedAt":"2026-09-11T17:15:08.753Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}