Skip to content

Credentials and GitHub Token

Jump to bottom
Loky edited this page Oct 13, 2026 · 2 revisions

Credentials and GitHub Token

Push / pull (SSH and HTTPS)

Gitot does not manage credentials. It uses your system Git's setup (SSH agent, Git Credential Manager, etc.) and does not suppress OS credential prompts.

  • If a command waits on a prompt, Gitot kills it after network_timeout_sec (default 120 s).
  • Make sure git push / git pull succeed from a terminal first.

GitHub Personal Access Token (PAT)

Only needed for the Issues Tracker.

Warning: the PAT is stored in plaintext in user://gitot_auth.cfg (outside res://, never committed). Godot/GDScript cannot reach the OS credential store without a native extension. Anyone with access to your user account can read it. On Linux and macOS Gitot restricts the file to your user (0600) after each save; on Windows no permission change is made.

Recommendations:

  • Use a fine-grained token limited to the repo, with Issues read/write only. Never an admin or org-wide token.
  • Click Clear Token in the Issues panel toolbar before uninstalling or disabling Gitot (it cannot be cleared automatically), or on a shared machine.
  • Don't need issues? Disable github_issues_enabled in Settings to unload the feature.
  • If a token expires or is revoked (HTTP 401), Gitot deletes it from the file and asks for a new one.

GitHub docs: Managing personal access tokens

Clone this wiki locally