Home / Help centre / Workspace settings
Workspace settings
How do I add an organization Git token for private repositories?
Open Settings, choose Git Access, paste a read-only token into Replace token and list the code hosts in Allowed hosts. Click Save Git settings, then Verify. Since scans only clone code, grant read access and nothing more.
Steps
White-box scans clone your repository over HTTPS. A public repository clones at launch with no token, but a private one needs this setup.
STEPSWhat to enter
Two fields do the work.
| Field | What to enter |
|---|---|
| Replace token | A read-only token from your code host |
| Allowed hosts | The domains the token may be sent to, for example git.example.com |
Good to know
Cyberlop only reads your code. The tab warns you to grant read-only repository access across all branches and nothing more. For one kind of host, that means a fine-grained token with Contents set to Read-only. For another, it means the read_repository scope or the Reporter role.
The token is stored encrypted at rest and never shown again. Leaving the field blank on a later visit keeps the stored value. SSH addresses are not supported, so use HTTPS repository URLs on your targets.
The status pill reads A Git token is configured. once a token is saved. The pill only says a token exists, so click Verify when you want proof that it works.
Team members can add their own token as well. Read how personal and organisation tokens differ to decide which fits your team. Questions? Visit the contact page.
Take a minute to plan the scope. A token that reaches every repository in your company is more power than a scan needs, so create it for the repositories you plan to test, and keep its expiry date in your calendar. Then rotate it on schedule. A small token is easy to replace later.
Related questions
- How do I limit which hosts the Git token is sent to?
- How do I check that my Git token works?
- How do I remove the organization's Git token?
- How do I add my own personal Git token?
- What permissions should my Git token have?
Git access in Cyberlop: set a read-only token and allowed hosts
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.