Keep credentials separate
Use scoped LFSPush tokens for files, with separate credentials for your Git host.
Personal and service tokens
Personal tokens follow the member's access and are revoked when that member is removed. Service tokens belong to the organization and should be reserved for named automation. Restrict both to the repositories and read/write permissions they need.
The token is shown once. If lost, rotate or replace it. Update your secure credential helper or CI secret, test the replacement, and revoke the old token. Never send a token to support.
Isolate repository credentials
Use a secure operating-system credential helper. With path matching enabled, a credential for one repository need not replace another repository's token. Enter lfspush as the username and the token as the password when Git prompts.
Your existing Git host credentials still authorize commits and Git refs. LFSPush credentials authorize LFS files. A GitHub login does not synchronize repository permissions or memberships.
git config --local credential.https://lfspush.dev.useHttpPath true
Avoid credential exposure
- Keep .lfsconfig limited to non-secret settings such as the endpoint.
- Do not place tokens in remote URLs, shell history, scripts, screenshots, or committed HTTP headers.
- In CI, inject credentials only for the fixed LFSPush origin and only in trusted jobs. Do not expose secrets to forked pull requests.
- A revoked token cannot mint new transfer URLs. Previously issued signed links can remain valid until their expiry: up to one hour for upload and 15 minutes for download.