'git credential fill' failed for url=%s, could not parse url

Error message

'git credential fill' failed for url=%s, could not parse url

What it means

Returned by runGitAuth when `git credential fill` succeeded (exit 0) but parseGitAuth could not extract any URL/prefix from its output. parseGitAuth reads protocol/host/path/username/password/url key=value lines; if none of protocol/host/path and no usable url line is present, parsedPrefix stays empty and the exporter cannot form a URL to associate the credential with.

Source

Thrown at src/cmd/go/internal/auth/gitauth.go:54

		// provides no way to enumerate existing credentials.
		// Wait for a request for a specific url.
		return "", nil, fmt.Errorf("no explicit url was passed")
	}
	if dir == "" {
		// Prevent config-injection attacks by requiring an explicit working directory.
		// See https://golang.org/issue/29230 for details.
		panic("'git' invoked in an arbitrary directory") // this should be caught earlier.
	}
	cmd := exec.Command("git", "credential", "fill")
	cmd.Dir = dir
	cmd.Stdin = strings.NewReader(fmt.Sprintf("url=%s\n", url))
	out, err := cmd.CombinedOutput()
	if err != nil {
		return "", nil, fmt.Errorf("'git credential fill' failed (url=%s): %w\n%s", url, err, out)
	}
	parsedPrefix, username, password := parseGitAuth(out)
	if parsedPrefix == "" {
		return "", nil, fmt.Errorf("'git credential fill' failed for url=%s, could not parse url\n", url)
	}
	// Check that the URL Git gave us is a prefix of the one we requested.
	if !strings.HasPrefix(url, parsedPrefix) {
		return "", nil, fmt.Errorf("requested a credential for %s, but 'git credential fill' provided one for %s\n", url, parsedPrefix)
	}
	req, err := http.NewRequest("HEAD", parsedPrefix, nil)
	if err != nil {
		return "", nil, fmt.Errorf("internal error constructing HTTP HEAD request: %v\n", err)
	}
	req.SetBasicAuth(username, password)
	// Asynchronously validate the provided credentials using a HEAD request,
	// allowing the git credential helper to update its cache without blocking.
	// This avoids repeatedly prompting the user for valid credentials.
	// This is a best-effort update; the primary validation will still occur
	// with the caller's client.
	// The request is intercepted for testing purposes to simulate interactions
	// with the credential helper.
	intercept.Request(req)

View on GitHub (pinned to b6b368adc5)

Solutions

Manually inspect `git credential fill` output: `printf 'url=https://example.com\n' | git credential fill`.
Ensure the credential helper returns protocol and host (or a full url line).
Switch to a standard helper (store/manager/osxkeychain) to isolate the issue.
Run with `go -x` to see the malformed URL log line emitted by parseGitAuth.

Defensive patterns

Strategy: validation

Validate before calling

// Sanity-check that git credential fill returns a parseable URL.
out, err := exec.Command("git", "credential", "fill").CombinedOutput()
// feed url=... on stdin
if err != nil { return err }
if !bytes.Contains(out, []byte("host=")) && !bytes.Contains(out, []byte("url=")) {
    return errors.New("credential helper returned no host/url information")
}

Prevention

Ensure the credential helper returns protocol+host or a full url line.
Prefer standard helpers (store/manager) over custom ones.
Inspect `git credential fill` output when debugging.

When it happens

Trigger: git's output contains username/password but omits protocol, host, path, and any usable url line, or those fields are all malformed (parseGitAuth silently skips a malformed url line).

Common situations: A custom or broken credential helper that returns credentials without host information; a git version emitting an unexpected output format; a helper that only stores username/password.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/78874b2d42c8c553. Report an issue: GitHub.