Home / Help centre / Workspace settings
Workspace settings
What's the difference between my personal Git token and the organization's Git token?
You save a personal Git token on My Account, and Cyberlop uses it first for scans you launch. An admin saves the organisation token under Settings, Git Access, and it is the shared fallback. Both clone private repositories over HTTPS, both should be read-only, and neither appears again after saving.
The short version
Both tokens do the same job. They let a white-box scan clone a private repository. The difference is whose token it is and when Cyberlop reaches for it. A personal token is yours alone. The organisation token belongs to the workspace.
How it works in Cyberlop
| Personal token | Organisation token | |
|---|---|---|
| Where you set it | My Account, Git access token card | Settings, Git Access tab |
| Who it serves | Scans you launch | Anyone whose scan has no personal token |
| Order of use | Tried first | The fallback |
| Extra controls | A single field and Save Git token | Allowed hosts, Verify and Clear token |
Cyberlop uses tokens set on My Account first for scans you launch, and it falls back to the organisation's shared token if you leave yours unset. Your personal token does not help a teammate's scan.
Only the shared token comes with a fence. Its Allowed hosts list makes Cyberlop send the token to the domains you name and nowhere else. Any repository on another host gets cloned without it, as if it were public.
Cyberlop encrypts both at rest and never shows either again. Keep both read-only, since scans only clone code. Public repositories need neither.
What to do next
Pick the model that fits your team, and write down who owns each token and when it expires. A shared token is simple to run, and one admin owns its rotation. Personal tokens suit teams where access differs by person, because each scan then clones with only what its owner may read.
To set up either one, read how to add your personal token or how to add the organisation token. For the exact order, see which token is used first. Questions go to the contact page.
Related questions
- How do I add my own personal Git token?
- How do I add an organization Git token for private repositories?
- If both I and my organization have a token set, which one does a scan use?
- How do I limit which hosts the Git token is sent to?
- Why did my scan use the organization's Git token instead of mine?
Git access in Cyberlop: set a read-only token and allowed hosts
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.