MokoGIT: Repository-Scoped Access Tokens

Details
Category: Reference
  • Applicable Software: MokoGIT
  • Min Version Number: 02.83.00
  • Max Version Number: Not Applicable

Two repository modes

  • All repositories (including future) - the default. The token can reach every repository you can access, including repositories you create later. This is the historical behavior, and all existing tokens keep it.
  • Only selected repositories - the token works only on a list of repositories you choose. A request to any repository outside that list is refused with 403 Forbidden, over both the REST API and git clone/push/pull over HTTPS. Repositories you create later are not added automatically - add them to the list when you want the token to reach them.

Set it in the web UI

Open Settings → Applications, create a token, and under Repository access choose All repositories (incl. future) or Only selected repositories and pick the repositories. Each repository-scoped token shows its allowed repositories in the token list so you can review it later.

Set it via the API

When creating a token (POST /api/v1/users/{username}/tokens), add two optional fields:

# All repositories (default) - just omit the fields:
curl -X POST -H "Authorization: token <TOKEN>" \
  -d '{"name":"ci","scopes":["read:contents"]}' \
  https://git.mokoconsulting.tech/api/v1/users/<user>/tokens

# Only selected repositories (by repository ID):
curl -X POST -H "Authorization: token <TOKEN>" \
  -d '{"name":"settings-sync","scopes":["write:contents"],"all_repos":false,"repo_ids":[123]}' \
  https://git.mokoconsulting.tech/api/v1/users/<user>/tokens
  • all_repos (default true) - when omitted or true, the token is unrestricted, including future repositories.
  • repo_ids - the list of repository IDs the token may use; honored only when all_repos is false.

Both fields are returned when you create or list tokens, and you can re-scope a token in place with PATCH /api/v1/users/{username}/tokens/{id}.

Good to know

  • Why 403 and not 404? A repository-scope denial is a restriction on your own token for a repository your account can otherwise see, so MokoGIT returns 403 Forbidden - distinct from the 404 you get when a token simply can’t see a private repository.
  • Empty list = all repositories. Choosing “Only selected repositories” but leaving the list empty falls back to all-repositories, so a token is never accidentally locked to zero repositories. Add at least one repository to actually restrict it.
  • Least privilege. Repository scope is ideal for automation - for example, a settings-sync token that can push to only one configuration repository instead of every repository you own.

See also: Managing your MokoGIT API keys (access tokens) for creating, rotating, editing, and revoking tokens.

Hits: 8