SSH keys and git tokens

Pushing to a Tokay hosted repository requires either an SSH key or a git token. Both combine live repository membership with explicit read or write grants, but they fit different environments.

Last updated

AI agent? Start with llms.txt.

Use an SSH key for normal local development

If you already push to GitHub or GitLab over SSH, adding the same public key to Tokay is usually the simplest choice. Add it in account settings or from the git setup flow, then use the SSH repository URL.

Choose all accessible repositories, one Workspace, or one repository when you register the key. You can allow reading alone or reading and writing. The grants are fixed at registration, and repository roles still decide whether the credential can read or push.

Tokay keys authenticate Git only. They never provide a shell or passwordless sudo access to your Workspace server.

SSH access may expire on a date you choose. Tokay stops accepting the registration at that time. The cryptographic key itself does not change or expire.

Use a git token when SSH is not practical

A git token is an HTTPS credential created by Tokay. It fits CI systems, restricted networks, and machines where you do not want to install a personal SSH key.

A token can cover all accessible repositories or be limited to one Workspace or repository, and to reading alone or reading and writing. It works only for git operations and cannot call the Tokay API or open the dashboard.

The value appears once at creation. Store it where the machine that needs it can read it. Expiry is optional, including no expiry.

People and Bots can use either encoding. A credential created in account or Bot settings is independent. A Git token or SSH registration created by an API or MCP credential is linked to that root, cannot outlive a finite root, and is revoked with its Lineage.

Revoke a credential when it should stop working

SSH keys and git tokens stop working immediately when revoked. Revocation is permanent. Removing a repository or Workspace also revokes either encoding when it is pinned to that target. Tokay never silently widens or narrows a credential's grants.

A rejected push usually points to one of three problems.

  • Permission denied over SSH means the key is missing, git offered a different key, or its fixed grant and your current membership do not both allow the operation. ssh-add -l shows the keys currently loaded.
  • Authentication failed over HTTPS means the token is wrong, revoked, or missing access to the repository.
  • Clone works but push fails means either the repository role or token is read only. Both must allow writing.

See Permissions for repository roles.