API authentication

Programs authenticate as you with a personal access token. A token can never do more than your account can; scopes and repository limits only narrow it.

Create a token

Go to Tokens settings and choose Generate token. Pick:

• Expiration: 7, 30, 60 or 90 days, 1 year, or none.
• Repository access: all repositories you can access, or only the ones you select.
• Permissions: for each area, no access, read-only, or read and write.

The token starts with upt_ and is shown once. Upstream stores only a hash of it.

Send the token

Use either header form:

Authorization: Bearer upt_...
Authorization: token upt_...

Tokens from upstream auth login (ucs_...) are accepted too, with every scope.

Scopes

Scope	Allows
repo:read	Read repositories, files, commits, branches, tags and releases
repo:write	Create repositories and forks, and push over HTTPS
repo:admin	Change repository settings, transfer and delete repositories
issues:read	Read issues, comments, labels and reactions
issues:write	Open and edit issues, comment, label, assign and react
changes:read	Read change requests, reviews and review comments
changes:write	Open, review, comment on and merge change requests
releases:write	Create and edit releases, and upload assets
checks:write	Report check runs and commit statuses
actions:read	Read workflows and workflow runs
actions:write	Dispatch, cancel and re-run workflows
webhooks:admin	Manage repository and organization webhooks
user:read	Read your profile
user:write	Update your profile
notifications:read	Read your notifications and mark them read
org:read	Read private organization membership
org:admin	Manage organizations, members and teams

A write scope includes the matching read scope, and repo:admin includes repo:write. Without the read scope for an area, the token reads that area like a signed-out visitor: public data still works and private data returns 404.

Repository access

A token limited to selected repositories can still read public repositories. Writes to any other repository return 403 with TOKEN_REPOSITORY_FORBIDDEN. Tokens limited to selected repositories can't create new repositories or forks, because the new repository wouldn't be on the list.

Git over HTTPS

A token with repo:read can clone and fetch, and one with repo:write can push. Use any non-empty username and the token as the password:

git clone https://git.coline.app/{namespace}/{repository}.git
# Username: x-token
# Password: upt_...

Pushes still follow branch protection and your repository role.

Organizations with SSO

If an organization requires SSO, authorize the token for it in the organization's security settings before using it on that organization's repositories.

Revoke and regenerate

Revoking a token stops it immediately. Regenerating replaces the secret and keeps the token's name, permissions and expiration. Each token shows when it was last used.