requested a credential for %s, but 'git credential fill' pro

Error message

requested a credential for %s, but 'git credential fill' provided one for %s

What it means

Returned by runGitAuth as a safety check: after git returns a parsedPrefix, the exporter verifies the requested URL starts with parsedPrefix. If git hands back credentials for a different (non-prefix-matching) URL, the mismatch is rejected. This protects against a credential helper or git config (url.*.insteadOf) returning credentials for an unrelated host.

Source

Thrown at src/cmd/go/internal/auth/gitauth.go:58

	if dir == "" {
		// Prevent config-injection attacks by requiring an explicit working directory.
		// See https://golang.org/issue/29230 for details.
		panic("'git' invoked in an arbitrary directory") // this should be caught earlier.
	}
	cmd := exec.Command("git", "credential", "fill")
	cmd.Dir = dir
	cmd.Stdin = strings.NewReader(fmt.Sprintf("url=%s\n", url))
	out, err := cmd.CombinedOutput()
	if err != nil {
		return "", nil, fmt.Errorf("'git credential fill' failed (url=%s): %w\n%s", url, err, out)
	}
	parsedPrefix, username, password := parseGitAuth(out)
	if parsedPrefix == "" {
		return "", nil, fmt.Errorf("'git credential fill' failed for url=%s, could not parse url\n", url)
	}
	// Check that the URL Git gave us is a prefix of the one we requested.
	if !strings.HasPrefix(url, parsedPrefix) {
		return "", nil, fmt.Errorf("requested a credential for %s, but 'git credential fill' provided one for %s\n", url, parsedPrefix)
	}
	req, err := http.NewRequest("HEAD", parsedPrefix, nil)
	if err != nil {
		return "", nil, fmt.Errorf("internal error constructing HTTP HEAD request: %v\n", err)
	}
	req.SetBasicAuth(username, password)
	// Asynchronously validate the provided credentials using a HEAD request,
	// allowing the git credential helper to update its cache without blocking.
	// This avoids repeatedly prompting the user for valid credentials.
	// This is a best-effort update; the primary validation will still occur
	// with the caller's client.
	// The request is intercepted for testing purposes to simulate interactions
	// with the credential helper.
	intercept.Request(req)
	go updateGitCredentialHelper(client, req, out)

	// Return the parsed prefix and headers, even if credential validation fails.
	// The caller is responsible for the primary validation.

View on GitHub (pinned to b6b368adc5)

Solutions

Inspect url rewriting rules: `git config --get-regexp 'url\..*\.insteadof'`.
Ensure the credential helper stores entries keyed on the actual host you fetch from.
Use a simpler helper (store) to isolate whether a custom helper is the cause.
Manually verify the returned prefix: `printf 'url=<your-url>\n' | git credential fill`.

Defensive patterns

Strategy: validation

Validate before calling

// Reject url-rewriting rules that would change the host before relying on GOAUTH=git.
out, err := exec.Command("git", "config", "--get-regexp", `url\..*\.insteadof`).Output()
if err == nil && len(out) > 0 {
    return fmt.Errorf("git url.insteadOf rules active; may cause credential host mismatch:\n%s", out)
}

Prevention

Avoid `url.<base>.insteadOf` rules that rewrite the module host.
Store credentials keyed on the actual fetch host.
Switch to the plain `store` helper to isolate custom-helper issues.

When it happens

Trigger: git's `credential fill` returns a url (or protocol+host+path) that does not prefix-match the requested URL — e.g. git rewrites or redirects to a different host, or the helper returns a stored credential for the wrong host.

Common situations: A gitconfig `url.<base>.insteadOf` rule rewriting the host; a corporate proxy rewriting the request; a custom helper returning the wrong entry; case-sensitivity differences in the host.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/f93e1c0f6b23ed94. Report an issue: GitHub.