diff --git a/spring-cloud-config-client/src/main/java/org/springframework/cloud/config/client/ConfigClientProperties.java b/spring-cloud-config-client/src/main/java/org/springframework/cloud/config/client/ConfigClientProperties.java
index 0f1a55cd..f21510b5 100644
--- a/spring-cloud-config-client/src/main/java/org/springframework/cloud/config/client/ConfigClientProperties.java
+++ b/spring-cloud-config-client/src/main/java/org/springframework/cloud/config/client/ConfigClientProperties.java
@@ -16,8 +16,11 @@
 
 package org.springframework.cloud.config.client;
 
+import java.io.UnsupportedEncodingException;
 import java.net.MalformedURLException;
 import java.net.URL;
+import java.net.URLDecoder;
+import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
 import java.util.HashMap;
 import java.util.Map;
@@ -342,9 +345,14 @@ public class ConfigClientProperties {
 				// But the username can be overridden
 				result.username = explicitCredentials.username;
 			}
+
+			result.password = URLDecoder.decode(result.password,
+					StandardCharsets.UTF_8.toString());
+			result.username = URLDecoder.decode(result.username,
+					StandardCharsets.UTF_8.toString());
 			return result;
 		}
-		catch (MalformedURLException e) {
+		catch (MalformedURLException | UnsupportedEncodingException e) {
 			throw new IllegalStateException("Invalid URL: " + uri, e);
 		}
 	}
diff --git a/spring-cloud-config-client/src/test/java/org/springframework/cloud/config/client/ConfigClientPropertiesTests.java b/spring-cloud-config-client/src/test/java/org/springframework/cloud/config/client/ConfigClientPropertiesTests.java
index a4c0de0a..d1e5d942 100644
--- a/spring-cloud-config-client/src/test/java/org/springframework/cloud/config/client/ConfigClientPropertiesTests.java
+++ b/spring-cloud-config-client/src/test/java/org/springframework/cloud/config/client/ConfigClientPropertiesTests.java
@@ -58,6 +58,15 @@ public class ConfigClientPropertiesTests {
 		assertThat(credentials.getPassword()).isEqualTo("bar");
 	}
 
+	@Test
+	public void uriCredsWithAtInPassword() {
+		this.locator.setUri(new String[] { "http://foo:bar%40@localhost:9999" });
+		Credentials credentials = this.locator.getCredentials(0);
+		assertThat(credentials.getUri()).isEqualTo("http://localhost:9999");
+		assertThat(credentials.getUsername()).isEqualTo("foo");
+		assertThat(credentials.getPassword()).isEqualTo("bar@");
+	}
+
 	@Test
 	public void explicitPassword() {
 		this.locator.setUri(new String[] { "http://foo:bar@localhost:9999" });
diff --git a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/support/GitCredentialsProviderFactory.java b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/support/GitCredentialsProviderFactory.java
index d31a6e31..5aa9db0e 100644
--- a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/support/GitCredentialsProviderFactory.java
+++ b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/support/GitCredentialsProviderFactory.java
@@ -92,6 +92,14 @@ public class GitCredentialsProviderFactory {
 			this.logger.debug("Constructing UsernamePasswordCredentialsProvider for URI " + uri);
 			provider = new UsernamePasswordCredentialsProvider(username, password.toCharArray());
 		}
+		else if (hasText(username) && !hasText(passphrase)) {
+			// useful for token based login gh-1602
+			// see
+			// https://stackoverflow.com/questions/28073266/how-to-use-jgit-to-push-changes-to-remote-with-oauth-access-token
+			this.logger.debug(
+					"Constructing UsernamePasswordCredentialsProvider for URI " + uri);
+			provider = new UsernamePasswordCredentialsProvider(username, (String) null);
+		}
 		else if (hasText(passphrase)) {
 			this.logger.debug("Constructing PassphraseCredentialsProvider for URI " + uri);
 			provider = new PassphraseCredentialsProvider(passphrase);
diff --git a/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/credentials/GitCredentialsProviderFactoryTests.java b/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/credentials/GitCredentialsProviderFactoryTests.java
index 621ca159..ef700e6e 100644
--- a/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/credentials/GitCredentialsProviderFactoryTests.java
+++ b/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/credentials/GitCredentialsProviderFactoryTests.java
@@ -60,12 +60,20 @@ public class GitCredentialsProviderFactoryTests {
 	}
 
 	@Test
-	public void testCreateForFileWithUsername() {
+	public void testCreateForFileWithUsernameAndPassword() {
 		CredentialsProvider provider = this.factory.createFor(FILE_REPO, USER, PASSWORD, null, false);
 		assertThat(provider).isNotNull();
 		assertThat(provider instanceof UsernamePasswordCredentialsProvider).isTrue();
 	}
 
+	@Test
+	public void testCreateForServerWithUsernameAndNoPassword() {
+		CredentialsProvider provider = this.factory.createFor(HTTPS_GIT_REPO, USER, "",
+				null, false);
+		assertThat(provider).isNotNull();
+		assertThat(provider instanceof UsernamePasswordCredentialsProvider).isTrue();
+	}
+
 	@Test
 	public void testCreateForServerNoUsernameIsNull() {
 		CredentialsProvider provider = this.factory.createFor(HTTPS_GIT_REPO, null, null, null, false);