How do I add my own personal Git token?

Steps

You do not need an admin for this. It is your own setting.

STEPS

Good to know

The page says tokens set here are used first for scans you launch, falling back to the organisation's shared token if you leave yours unset. Scans started by other people do not use your token.

Use a read-only token, as the organisation tab advises, because Cyberlop only clones code. The field shows the usual prefixes of code-host tokens as a hint. Your token may look different.

Cyberlop encrypts secrets at rest and never shows them again after saving. Expect the field to look empty on your next visit.

Repository URLs must be HTTPS. Cyberlop does not support SSH addresses.

The organisation also has a shared token, which an admin manages. For the contrast, read personal and organisation Git tokens. To learn the order of use, see which token comes first. Stuck? Try the contact page.

When you leave a project or change roles, replace or remove your token so that it matches the access you now have. A token that outlives its purpose is a risk to you and to the repositories behind it. Rotate it on the same cycle your code host recommends.

Short and simple: one token, read access, saved once. Because it takes under a minute to add, you can have private repositories scanning well before your next planning meeting.

Related questions

• What's the difference between my personal Git token and the organization's Git token?
• If both I and my organization have a token set, which one does a scan use?
• How do I add an organization Git token for private repositories?
• Why did my scan use the organization's Git token instead of mine?
• What permissions should my Git token have?

Full tutorial

Account and organisation settings: notifications, retention, logo and plan

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre