# Access tokens and scopes

git, the CLI, the API and MCP sign in with an access token. Each token has scopes, belongs to one organization, the ones you pick from the CLI, or all of them, can be limited to some repositories, and always expires.

## Personal and agent tokens

| Token | Starts with | Made by | Expires |
| --- | --- | --- | --- |
| Personal | `dgp_` | You, at [/settings/tokens](https://rebasely.com/settings/tokens), or `rebasely auth login` | after 1 to 365 days (90 by default), or after a year unused |
| Agent | `dga_` | An owner, for an [agent](https://rebasely.com/docs/agents) | after at most 90 days (30 by default) |

A token is shown once, when it is made; Rebasely keeps only a hash. You get an email a week before one expires. Creating a token needs a [recent confirmation](https://rebasely.com/docs/sign-in#confirm), and no token can create another.

## Scopes

| Scope | Allows |
| --- | --- |
| `repo:read` | Clone, fetch and read repositories |
| `repo:write` | Push, open, review and merge pull requests, and use sandboxes (includes repo:read) |
| `repo:create` | Create private repositories |
| `repo:admin` | Repository settings (owners only) |
| `org:admin` | Organization settings (owners only) |
| `actions:read`, `actions:write` | Read runs and logs; start and cancel runs |
| `statuses:write` | Post commit statuses |
| `live:read`, `live:write` | Read and edit live branches |
| `sandbox:write` | Sandboxes (agents only; a person's token uses repo:write) |

A token never does more than its owner's role allows: a reader's token can only read. `rebasely auth login` asks for `repo:read`, `repo:write`, `repo:create`, `live:read` and `live:write` by default, and never for the admin scopes.

## Tokens for all your organizations

A personal token can work in every organization you belong to instead of a fixed list. Pick "All organizations you belong to" in the token form, or run `rebasely auth login --all-orgs` and keep that choice on the approval page.

- It covers the organizations you are a member of when each request arrives: one you join later is included, one you leave is not. Changes take effect within 30 seconds.
- In each organization it acts with your role there. A scope your role does not allow does nothing: `repo:admin` or `org:admin` works only where you are an owner, `repo:create` and `repo:write` only where you are a writer or owner.
- Your scopes must be ones some role you hold allows when you create it. It cannot be limited to repositories.
- Making a repository public, and everything else that needs an owner's approval, still goes through an [approval](https://rebasely.com/docs/agents#approvals) confirmed with a passkey or Google.
- It expires after 90 days unless you pick fewer, and never after more than 365.
- Agent tokens are always for one organization and can never be for all of them.

Your token list shows these tokens as "All organizations", with when and in which organization each was last used. The audit log of each organization records what the token did there. An owner of one of your organizations sees the token in that organization's token list and can remove their organization from it; it keeps working in your other organizations. Revoking it yourself, or signing out everywhere, ends it everywhere.

## Using a token with git

```sh
rebasely auth login            # approve in the browser; git's credential helper keeps it
rebasely auth login --all-orgs # one token for every organization you belong to, now and later
rebasely auth status           # the account, organizations, scopes and expiry
rebasely auth logout           # revoke it and remove it from the helper
```

Without the CLI, paste the token when git asks for a password (any user name works). For scripts and agents, put it in `REBASELY_TOKEN`; the CLI sends it only to Rebasely's own hosts. In API calls, send `Authorization: Bearer <token>` to `https://rebasely.com/api/v1`.

## When a token leaks into a push

> **Warning:** If a push contains an active Rebasely token, Rebasely refuses the push, revokes the token at once and emails its owner. Remove it from every commit of the push, create a new token and keep it out of the repository. The same happens to the private half of a registered SSH key, which is then blocked for good.

Revoke a token any time at [/settings/tokens](https://rebasely.com/settings/tokens). Owners see and revoke the tokens of their organization in its settings.

---

Source: https://rebasely.com/docs/tokens