Best Practice to get Git Write Authorization on Build Agent

I have a VCS connected to build, but at the during the build I want to push a new branch. The authentication information is removed before the build starts, what is a secure way to get them on the agent for use?