#GitHub access

To clone your repo, push commits, and open pull requests, a chatspace needs access to GitHub. Chatspaces does this with a GitHub App that grants narrow, short-lived access to the single repo you're working on — never blanket access to your account.

#The model

• Per repo. Access is scoped to exactly the repository your chatspace is using. Other repos are untouched.

• Least privilege. Within that repo, the token can do the job a coding agent needs and little else:

  • Read & write code (contents) and pull requests
  • Read issues and CI/check results
  • Repo metadata

  It can't administer the repo, change settings, manage members, or touch your other repos.

• Short-lived. Tokens last at most an hour and are refreshed as needed. There's no long-lived key sitting around.

• Commits are yours. Pushes are made with the app's token, but commits are authored as you, so your contribution graph stays correct.

#Installing the app

When you select a repo whose owner hasn't installed the Chatspaces GitHub App — including a brand new repo you create — the app prompts you to install it on GitHub. You choose:

• which account or organization to install on, and
• whether to grant access to all repositories or only selected ones.

The install opens in an in-app browser and brings you straight back to Chatspaces when it's done. Once installed, Chatspaces can mint scoped tokens for the repos you allowed, and the repo picker updates to show they're ready.

#Revoking access

You're always in control. Revoke any time on GitHub:

GitHub → Settings → Applications → Installed GitHub Apps → Chatspaces → Configure/Uninstall.

You can narrow which repos are shared, or remove the app entirely. Revocation takes effect right away — the next time a chatspace tries to get a token, it simply won't get one.

#How the token is protected

The agent fetches a fresh, scoped token only when git or gh actually needs one, and brokers it locally — the coding assistant itself never holds your GitHub token. Combined with the per-repo, one-hour scope, that keeps the blast radius small.

#Bring your own token

Prefer to use your own credentials? Set a GITHUB_TOKEN in an environment and the chatspace will use that for git and gh instead of the managed app token. This is handy if you need a scope the app doesn't grant, or you'd rather manage access yourself.

A few things to know:

• Your token is treated like any other secret in an environment (encrypted, write-only, injected at start).
• Chatspaces can't scope, refresh, or revoke a token you supply — that's on you. Use the narrowest token that does the job, and rotate it when you're done.
• Setting GITHUB_TOKEN to an empty value turns off the managed token without adding a replacement (a chatspace with no GitHub write access).

Next: how usage is measured and limited, or plans & billing.