How do I remove the organization's Git token?

Steps

Think about which scans rely on the token before you remove it.

STEPS

Good to know

Public repositories clone at launch without any token. Private repositories need a Git token, either personal or from the organisation. After you clear the organisation token, a white-box scan of a private repository works only for people who saved a personal token on My Account.

Cyberlop tries personal tokens first for scans you launch. The organisation token is the fallback. Clearing the fallback leaves personal tokens alone. Read which token is used first for the full order.

Changes to Git tokens appear in the Activity feed, so your team can see who made the change.

Want to swap the token rather than remove it? Paste the new one into Replace token and save. There is no need to clear first.

Removing a token here does not revoke it at your code host. If the token may be exposed, revoke it there too. Cyberlop can delete only its own stored copy.

Need to set one up again later? Follow the setup steps or ask on the contact page.

Before you clear the token, list the targets that use private repositories and tell their owners. A scheduled scan will keep running on its timetable, and it needs some token to clone the code. If nobody holds a personal one, those runs will have nothing to use. A short message now avoids a surprise later, and it gives each owner time to add a personal token if they want scans to keep running without a gap in coverage.

Related questions

• How do I add an organization Git token for private repositories?
• How do I check that my Git token works?
• How do I add my own personal Git token?
• If both I and my organization have a token set, which one does a scan use?
• What's the difference between my personal Git token and the organization's Git token?

Full tutorial

Git access in Cyberlop: set a read-only token and allowed hosts

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre