My private repository won't clone. What do I need?

Why this happens

Without a token, Cyberlop treats a repository as public, and a private one then refuses the clone, because nobody has shown it a credential. The token is also only sent to hosts you list, so a repository on an unlisted host is cloned with no token at all. SSH addresses are not supported.

How to fix it

1. Check Repository on the target page. The address must start with https://.
2. Go to Settings → Git Access. The pill should read "A Git token is configured."
3. Paste a read-only token into Replace token. The needed access depends on your code host. One asks for a fine-grained token with Contents read-only, and another asks for read_repository or the Reporter role.
4. In Allowed hosts, type the domain of your code host.
5. Click Save Git settings, then Verify.
6. Open My Account and check Git access token. A personal token there is used first, so a wrong one can override a good organisation token.
7. Press ▷ Scan again.

Still not working?

• Grant the token read access to the repository, including the branch named on the target.
• Ask an admin to check the settings if you cannot see Settings.
• Use Clear token and save a fresh one if you suspect the old one is wrong.

Our guide to scanning a private repository has the full set-up. If the clone still fails, use /contact.

Related questions

• How do I scan a private repository?
• Why is my repository being cloned without my Git token?
• Why isn't my git@ SSH repository URL accepted?
• The token field stays blank after saving. How can I tell whether my Git token saved?
• How do I connect a Git repository to a target?

Full tutorial

Git access in Cyberlop: set a read-only token and allowed hosts

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre