My problem is described perfectly here, but I don't think the solution is the correct one, since that would use the credentials stored on the computer as far as I'm aware.

When making git requests to an azure repository with a PAT, it is expected to be passed along as a custom header. (see documentation).

This is possible when doing a Clone operation, since CloneOptions contains FetchOptions, which allows us to set custom headers.

So a clone is perfectly possible as follows:

string encodedToken = Convert.ToBase64String(Encoding.UTF8.GetBytes($":{credentials.PersonalAccessToken}"));
var fetchOptions = new FetchOptions
{
    CustomHeaders = new[] {
        $"Authorization: Basic {encodedToken}"
    }
};
var options = new CloneOptions
{
    CredentialsProvider = (url, usernameFromUrl, types) =>
                    new UsernamePasswordCredentials()
                    {
                        Username = credentials.UserName,
                        Password = credentials.PersonalAccessToken
                    },
    FetchOptions = fetchOptions,
    BranchName = branchName,
    Checkout = true,
    OnCheckoutProgress = (path, completedSteps, totalSteps) =>
        Logger.LogInformation("Clone progress {completed} / {total}", completedSteps, totalSteps),
    RepositoryOperationCompleted = (context) =>
        Logger.LogInformation("Clone completed"),
};

Repository.Clone(Remote, WorkingDirectory, options);

However, when trying to push to this same repository, PushOptions does not expose something similar to include the PAT as header, even though it is stored in the internal data structure since #1233 .

Using the provided example from the wiki
I get the following error:
Unhandled exception: too many redirects or authentication replays | LibGit2Sharp.LibGit2SharpException | too many redirects or authentication replays
Which is the exact same error I was getting when trying to clone without the added custom header.

As far as I can see, there is a PR open that would fix this, but it is not yet merged in: #2011