Accounts & keys

Your identity is a nostr keypair. ngit stores the secret in your OS credential store by default. Git config holds the name of the credential entry, not the key itself.

Logging in

ngit account login                            # interactive
ngit account login --bunker-url bunker://...  # NIP-46 remote signer
ngit account create --name "Alice"            # new identity

--local scopes any of these to the current repository instead of globally:

ngit account login --local

Remote signers

A NIP-46 bunker keeps the secret key on another device. It never touches this machine. ngit account login interactively shows a QR code and a nostrconnect:// string; --bunker-url takes a connection non-interactively.

Where the secret goes

Storage	Behaviour
auto (default)	OS credential store, falling back to ngit's user-only file store
file	ngit's user-only file store
git-config	Plaintext in git config, which must be requested explicitly

ngit account login --secret-storage file

Set it persistently with NGIT_SECRET_STORAGE or nostr.secret-storage.

Several identities

Aliases name stored signers without exposing their secrets:

ngit account login --nsec-file /private/key --alias alice
ngit account login alice                # make alice the global default
ngit account login --local alice        # make alice this repository's default

To use a non-default identity for one command, don't switch logins:

ngit --signer alice issue create --subject "Bug" --body "Details"
git -c nostr.signer=alice push origin pr/topic

--signer accepts an alias, an npub, or an exact cached profile name. It fails closed. A missing, ambiguous or invalid selector is an error, never a silent fallback to your default key.

Note that --signer covers ngit commands only. A git push needs git's own -c nostr.signer=..., because git is what runs at that point.

Seeing what you have

ngit account whoami
ngit account whoami --offline

Combines signers from local, global and system git config, the OS credential store and credentials.json. It groups aliases under their account, marks which login scopes are set, and shows which account currently wins git's scope precedence. This is useful when a repository-local login is shadowing your global one.

ngit account list is the same command.

Logging out

ngit account logout              # remove login config, keep the stored secret
ngit account logout --forget     # also delete the stored secret
ngit account forget-keys <entry> # delete a preserved credential entry
ngit account export-keys         # print the stored secret

Logging out of a repository-local login can reveal a shadowed global default. whoami will show you which. Treat export-keys output as a secret and never paste it into logs, issues, or command history.

CI and automation

Pass a key for one command without logging in. Prefer secret files or a secret manager over command-line values, which may be visible in the process list:

ngit --nsec-file /run/credentials/nostr-key \
  issue create --subject "Automated report" --body "Details" --json

ngit --nbunksec-file /run/credentials/signer-connection \
  pr list --json

After an initial online read has populated the cache, add --offline where the specific command supports it.

An nbunksec file contains a portable established remote-signer connection: signer pubkey, client key, relays, and optional pairing secret. It doesn't contain your npub, so one-shot use resolves the identity from the signer.

Next

• Configuration
• Generated account reference