Access tokens and scopes
git, the CLI, the API and MCP sign in with an access token. Each token has scopes, belongs to one organization, the ones you pick from the CLI, or all of them, can be limited to some repositories, and always expires.
Personal and agent tokens
| Token | Starts with | Made by | Expires |
|---|---|---|---|
| Personal | dgp_ | You, at /settings/tokens, or rebasely auth login | after 1 to 365 days (90 by default), or after a year unused |
| Agent | dga_ | An owner, for an agent | after at most 90 days (30 by default) |
A token is shown once, when it is made; Rebasely keeps only a hash. You get an email a week before one expires. Creating a token needs a recent confirmation, and no token can create another.
Scopes
| Scope | Allows |
|---|---|
repo:read | Clone, fetch and read repositories |
repo:write | Push, open, review and merge pull requests, and use sandboxes (includes repo:read) |
repo:create | Create private repositories |
repo:admin | Repository settings (owners only) |
org:admin | Organization settings (owners only) |
actions:read, actions:write | Read runs and logs; start and cancel runs |
statuses:write | Post commit statuses |
live:read, live:write | Read and edit live branches |
sandbox:write | Sandboxes (agents only; a person's token uses repo:write) |
A token never does more than its owner's role allows: a reader's token can only read. rebasely auth login asks for repo:read, repo:write, repo:create, live:read and live:write by default, and never for the admin scopes.
Tokens for all your organizations
A personal token can work in every organization you belong to instead of a fixed list. Pick "All organizations you belong to" in the token form, or run rebasely auth login --all-orgs and keep that choice on the approval page.
- It covers the organizations you are a member of when each request arrives: one you join later is included, one you leave is not. Changes take effect within 30 seconds.
- In each organization it acts with your role there. A scope your role does not allow does nothing:
repo:adminororg:adminworks only where you are an owner,repo:createandrepo:writeonly where you are a writer or owner. - Your scopes must be ones some role you hold allows when you create it. It cannot be limited to repositories.
- Making a repository public, and everything else that needs an owner's approval, still goes through an approval confirmed with a passkey or Google.
- It expires after 90 days unless you pick fewer, and never after more than 365.
- Agent tokens are always for one organization and can never be for all of them.
Your token list shows these tokens as "All organizations", with when and in which organization each was last used. The audit log of each organization records what the token did there. An owner of one of your organizations sees the token in that organization's token list and can remove their organization from it; it keeps working in your other organizations. Revoking it yourself, or signing out everywhere, ends it everywhere.
Using a token with git
rebasely auth login # approve in the browser; git's credential helper keeps it
rebasely auth login --all-orgs # one token for every organization you belong to, now and later
rebasely auth status # the account, organizations, scopes and expiry
rebasely auth logout # revoke it and remove it from the helperWithout the CLI, paste the token when git asks for a password (any user name works). For scripts and agents, put it in REBASELY_TOKEN; the CLI sends it only to Rebasely's own hosts. In API calls, send Authorization: Bearer <token> to https://rebasely.com/api/v1.
When a token leaks into a push
Revoke a token any time at /settings/tokens. Owners see and revoke the tokens of their organization in its settings.