Keys and scopes
A key is a deliberate permission grant. Select its repository scope, capabilities and UTC expiry before issuing it.
Capabilities
| Capability | What it permits |
|---|---|
read | Clone, fetch and inspect repository content. |
write | Push work to permitted branches. |
merge | Merge a pull request into protected main. |
replace | Start and finish deliberate history replacement; requires read and write. |
delegate | Issue a child key with narrower scope, capabilities and expiry. |
publish | Append to protected main where the documented publish flow is available. |
A write key alone cannot force or delete main. Merge authority is independent of write. The service checks capability dependencies rather than silently granting extra rights.
Scope and expiry
Prefer one repository and the shortest useful lifetime. Advanced organisation-wide authority is a separate explicit choice. A child cannot add a repository, capability or lifetime that its parent lacks.
One-time secrets
Only the issuance response contains the secret. It is not recoverable from the key list. Keep it in trusted runtime configuration or a credential helper, outside browser persistence, query caches and logs.
If an issuance response is lost, first resolve the original operation using its replay metadata. Revoke the uniquely identified key before issuing another. If it cannot be identified safely, ask an operator to reconcile it; do not guess.
Revocation
Review the public key ID and consequence before revoking. A revoked parent invalidates delegated descendants. Independent root keys are unaffected. An already authorised stream may finish; later requests are denied.