git-ecosystem/git-credential-manager · error · Exception

Can only use the ' ' credential store on Windows. See for…

Error message

Can only use the '{StoreNames.Dpapi}' credential store on Windows.
See {Constants.HelpUrls.GcmCredentialStores} for more information.

What it means

ValidateDpapi enforces that the DPAPI-protected credential store is only used on Windows. When the configured store is dpapi but the current OS is not Windows, GCM logs the error and throws with a link to the credential-store docs. DPAPI relies on Windows-protected data APIs unavailable elsewhere.

Solutions

Choose a platform-appropriate store: `git config --global credential.credentialStore keychain` (macOS) or `secretservice`/`gpg` (Linux).
Remove the dpapi setting from shared configs; scope it per-OS with conditional includes.
If you intend Windows behavior inside WSL, either run git from Windows or configure GCM for a Linux store in WSL.
Review the help URL in the error for supported stores per platform.

Example fix

// before (macOS with Windows config)
[credential]
	credentialStore = dpapi

// after
[credential]
	credentialStore = keychain

Defensive patterns

Strategy: validation

Validate before calling

bool isWindows = RuntimeInformation.IsOSPlatform(OSPlatform.Windows);
var store = "$(git config --global credential.credentialStore)".Trim();
if (!isWindows && (store == "dpapi" || store == "wincredman"))
    throw new InvalidOperationException("dpapi is Windows-only; choose keychain (macOS) or secret-service/gpg (Linux)");

Try / catch

try
{
    credentialStore.Get(serviceName);
}
catch (Exception ex) when (ex.Message.Contains("Can only use the 'dpapi'"))
{
    // reconfigure to a store supported on this OS and retry
}

Prevention

Scope dpapi/wincredman settings to Windows-only machines via conditional includes.
Sanitize synced dotfiles before applying on macOS/Linux.
Set GCM_CREDENTIAL_STORE per environment in provisioning scripts, not in shared exports.
Use separate configs for Windows and WSL.

When it happens

Trigger: EnsureBackingStore resolves the configured store to dpapi and calls ValidateDpapi while PlatformUtils.IsWindows() is false — e.g. GCM_CREDENTIAL_STORE=dpapi or credential.credentialStore=dpapi on Linux/macOS.

Common situations: Copying a Windows machine's .gitconfig or GCM_CREDENTIAL_STORE export to WSL/macOS/Linux; shared dotfiles that pin dpapi; CI images on Linux reusing Windows developer config.

Understand the failure class

Background: "unsupported platform" / "not supported on this platform" errors: what they mean and how to fix them — this error's family across 47 libraries.

Related errors

AI-assisted analysis of git-ecosystem/git-credential-manager@e8ce762cd0 (2026-09-11). Data as JSON: /api/errors/ecbce39de123c2e3. Report an issue: GitHub.

Appendix: source

Thrown at src/Core/CredentialStore.cs:224

            }

            if (!WindowsCredentialManager.CanPersist())
            {
                var message = $"Unable to persist credentials with the '{StoreNames.WindowsCredentialManager}' credential store.";
                _context.Trace2.WriteError(message);
                throw new Exception(message + Environment.NewLine +
                    $"See {Constants.HelpUrls.GcmCredentialStores} for more information."
                );
            }
        }

        private void ValidateDpapi(out string storeRoot)
        {
            if (!PlatformUtils.IsWindows())
            {
                var message = $"Can only use the '{StoreNames.Dpapi}' credential store on Windows.";
                _context.Trace2.WriteError(message);
                throw new Exception(message  + Environment.NewLine +
                    $"See {Constants.HelpUrls.GcmCredentialStores} for more information."
                );
            }

            // Check for a redirected credential store location
            if (!_context.Settings.TryGetSetting(
                Constants.EnvironmentVariables.GcmDpapiStorePath,
                Constants.GitConfiguration.Credential.SectionName,
                Constants.GitConfiguration.Credential.DpapiStorePath,
                out storeRoot))
            {
                // Use default store root at ~/.gcm/dpapi_store
                storeRoot = Path.Combine(_context.FileSystem.UserDataDirectoryPath, "dpapi_store");
            }
        }

        private void ValidateMacOSKeychain()
        {

View on GitHub (pinned to e8ce762cd0)