Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Minimal set of scopes to push to github using an access token

Tags:

git

github

push

I have a public github repo (I created a few years ago). I have two factor authentication enabled. I want to create a github API token to be able to push some changes to my repo.

What is the minimal set of scopes that I must select in the github "New personal access token" page to be able to push changes to this repo?

I want to avoid to give any rights that are unnecessary to the token.

like image 920
Fabian Avatar asked Sep 15 '20 16:09

Fabian


People also ask

How do I get a token for multiple scopes?

When requesting multiple scopes, the token is saved with a normalized list of scopes, discarding those that are implicitly included by another requested scope. For example, requesting user,gist,user:email will result in a token with user and gist scopes only since the access granted with user:email scope is included in the user scope.

How do I generate a personal access token for GitHub?

GitHub has personal access token (PAT), to use in place of a password with the command line or with the API. Below is how to generate the token and use it: Create a token in GitHub Log in to GitHub and navigate to the Settings page as shown below:

What is a GitHub API Token used for?

This token can also be used to access the Github API, but that isn’t necessary for most people’s usage. You can also switch to SSH based authentication, which works pretty similarly to access tokens, except they’re tied to your machine and not transmitted anywhere.

What is the difference between user and gist scopes when requesting user?

For example, requesting user,gist,user:email will result in a token with user and gist scopes only since the access granted with user:email scope is included in the user scope.


1 Answers

According to the GitHub documentation, the scope for public repositories is public_repo, and for private repositories is repo.

A token with one of those scopes is the most limited access possible for Git push or pull access; however, that token can access all public (respectively, private) repositories and can also be used for certain API access as well. If that's of concern to you, you can use an SSH key for your personal account, or to restrict it even further, a read-write deploy key for the repo in question.

like image 192
bk2204 Avatar answered Sep 19 '22 04:09

bk2204