Credentials and tokens

Upstream uses different credentials for Git transport and HTTP APIs. Use the narrowest credential that fits the client.

Git credentials

Repository-scoped HTTPS credentials can allow read or write. They expire, can be revoked, and are shown only once. Use them as the password with any non-empty Git username.

SSH keys

Account SSH keys authenticate standard SSH Git remotes. Add and revoke keys in SSH key settings.

API tokens

Workspace API tokens use bearer authentication and explicit scopes. The token is shown once and stored hashed. Create tokens in API token settings.

CLI sessions

The Upstream CLI uses a browser-approved session and the operating system credential store. Its Git credential helper requests short-lived repository credentials and clamps requested access to your actual repository role.

Automation guidance

• Never place a user session cookie in a runner.
• Use read-only repository credentials for checkout unless the job must push.
• Give API tokens only the scopes the integration calls.
• Rotate credentials when ownership or provider configuration changes.
• Keep one credential per service and repository so revocation is precise.