diff --git a/pom.xml b/pom.xml
index 18b8c7bcb4..63555d8492 100644
--- a/pom.xml
+++ b/pom.xml
@@ -195,6 +195,10 @@
       <groupId>org.jenkins-ci.plugins</groupId>
       <artifactId>credentials</artifactId>
     </dependency>
+    <dependency>
+      <groupId>org.jenkins-ci.plugins</groupId>
+      <artifactId>plain-credentials</artifactId>
+    </dependency>
     <dependency>
       <groupId>org.jenkins-ci.plugins</groupId>
       <artifactId>script-security</artifactId>
diff --git a/src/main/java/org/jenkinsci/plugins/gitclient/CliGitAPIImpl.java b/src/main/java/org/jenkinsci/plugins/gitclient/CliGitAPIImpl.java
index ae0e73766e..c8f77a1379 100644
--- a/src/main/java/org/jenkinsci/plugins/gitclient/CliGitAPIImpl.java
+++ b/src/main/java/org/jenkinsci/plugins/gitclient/CliGitAPIImpl.java
@@ -71,6 +71,7 @@
 import org.eclipse.jgit.transport.RemoteConfig;
 import org.eclipse.jgit.transport.URIish;
 import org.jenkinsci.plugins.gitclient.cgit.GitCommandsExecutor;
+import org.jenkinsci.plugins.plaincredentials.StringCredentials;
 import org.jenkinsci.plugins.scriptsecurity.sandbox.whitelists.Whitelisted;
 import org.kohsuke.stapler.framework.io.WriterOutputStream;
 
@@ -2150,6 +2151,15 @@ private String launchCommandWithCredentials(
                 env = new EnvVars(env);
                 env.put("GIT_ASKPASS", askpass.toAbsolutePath().toString());
                 env.put("SSH_ASKPASS", askpass.toAbsolutePath().toString());
+
+            } else if (credentials instanceof StringCredentials) {
+                var stringCred = (StringCredentials) credentials;
+                listener.getLogger().println("using GIT_CONFIG to set token header " + stringCred.getDescription());
+
+                env = new EnvVars(env);
+                env.put("GIT_CONFIG_COUNT", "1");
+                env.put("GIT_CONFIG_KEY_0", "http.extraHeader");
+                env.put("GIT_CONFIG_VALUE_0", "Authorization: Bearer " + stringCred.getSecret());
             }
 
             if ("http".equalsIgnoreCase(url.getScheme()) || "https".equalsIgnoreCase(url.getScheme())) {
diff --git a/src/main/java/org/jenkinsci/plugins/gitclient/GitClient.java b/src/main/java/org/jenkinsci/plugins/gitclient/GitClient.java
index bc8fd0638f..7579061155 100644
--- a/src/main/java/org/jenkinsci/plugins/gitclient/GitClient.java
+++ b/src/main/java/org/jenkinsci/plugins/gitclient/GitClient.java
@@ -23,6 +23,7 @@
 import org.eclipse.jgit.transport.RefSpec;
 import org.eclipse.jgit.transport.RemoteConfig;
 import org.eclipse.jgit.transport.URIish;
+import org.jenkinsci.plugins.plaincredentials.StringCredentials;
 
 /**
  * Interface to Git functionality.
@@ -47,7 +48,8 @@ public interface GitClient {
      */
     CredentialsMatcher CREDENTIALS_MATCHER = CredentialsMatchers.anyOf(
             CredentialsMatchers.instanceOf(StandardUsernamePasswordCredentials.class),
-            CredentialsMatchers.instanceOf(SSHUserPrivateKey.class));
+            CredentialsMatchers.instanceOf(SSHUserPrivateKey.class),
+            CredentialsMatchers.instanceOf(StringCredentials.class));
 
     /**
      * Remove all credentials from the client.