Creating an access token
- Sign in to MokoGIT and open User Settings (your avatar, top right → Settings).
- Go to Applications → Access Tokens.
- Enter a clear Token Name that says where it will be used (for example, ci-deploy-laptop or backup-script).
- Choose the Scopes the token needs (see below). Grant the least access required.
- Optionally set an Expiration (see below).
- Click Generate Token.
- Copy the token now and store it securely. You will not be able to see it again.
Scopes (permissions)
Scopes control what a token is allowed to do. Rather than granting full account access, pick only the categories the integration needs, and prefer read-only where possible. Common scope groups include:
- repository — read or read/write access to your repositories' code, issues, and pull requests.
- organization — manage organizations and teams you administer.
- user — read or update your account profile and settings.
- packages — read or publish packages.
- admin — administrative operations (only if you are an instance admin and the tool truly needs it).
Each group typically offers a read and a write level. Choose read unless the tool must make changes.
Setting an expiration
Long-lived tokens are a common security risk: if one leaks, it stays valid indefinitely. When you create a token you can set an expiration date — pick a preset (for example 30, 60, or 90 days) or a custom date, or choose No expiration. After the expiry date the token stops working and is automatically rejected, so a forgotten key cannot be used forever. Each token's expiration is shown in the token list (Expires, Expired, or Never expires). Rotate to a fresh token before the old one lapses.
Sorting and filtering your tokens
As you accumulate tokens over time it becomes hard to tell which are still in use. Above the token list you can sort and filter your access tokens:
- Sort by — Created, Last used, Expiration, or Name (ascending or descending). Tokens that have never been used sort to the bottom under Last used; tokens with no expiry sort to the bottom under Expiration.
- Show — All, Active, Expired, or Never used. Filtering to Never used or by Last used is the fastest way to spot stale keys that nothing is using anymore, so you can revoke them.
[Coming soon] The same sort/filter is planned to extend to OAuth applications and to deploy, SSH, and GPG keys.
Revoking a token
To revoke a token, return to User Settings → Applications → Access Tokens, find the token by name, and click Delete. Revocation takes effect immediately; any tool still using that token will start receiving authentication errors and should be updated with a new one.
Security best practices
- Least scope — grant only the permissions the tool needs, and prefer read-only.
- Set an expiration — prefer a dated token over an indefinite one, and rotate before it lapses.
- One token per use — use a separate, clearly named token for each tool or machine, so you can revoke one without breaking the others.
- Rotate regularly — replace tokens on a schedule, and immediately if one may have been exposed.
- Revoke what you do not use — delete tokens for retired scripts, old laptops, or former integrations (use the Never used filter to find them).
- Never commit tokens — keep them out of source code, screenshots, and chat; store them in a secret manager or CI secret.