Documentation
Request private-repository access safely
Coming soon. Planned worked example, not available yet in production.
Before you start
Once available, you will request a short-lived token for one repository selected in your workspace’s GitHub App installation. This local Python example requests read access and prints metadata only. Set TENANT_ID, SANDBOX_ID and RUNZIVO_TOKEN securely in your client environment. Replace OWNER/REPOSITORY. The sandbox will need to be running. Your key will need sandboxes:write and repositories:read.
Planned example
# Planned API example. Run it locally only after the feature is available.
import json, os, urllib.request
base = "https://api.runzivo.dev/v1/customer/tenants"
url = f"{base}/{os.environ['TENANT_ID']}/sandboxes/{os.environ['SANDBOX_ID']}/repository-token"
request = urllib.request.Request(url, method="POST",
data=json.dumps({"repository": "OWNER/REPOSITORY", "push": False}).encode(),
headers={"Authorization": "Bearer " + os.environ["RUNZIVO_TOKEN"],
"Content-Type": "application/json"})
with urllib.request.urlopen(request) as response:
credential = json.load(response)
# Inspect metadata only. Never print or persist credential["token"].
print({key: credential[key] for key in ("repository", "permission", "expires_at")})Review and protect your work
The token will stay in local process memory and normally expire after one hour. This example does not clone into the sandbox or sign in Codex or Claude Code automatically. Guest credential delivery is not available. Do not put the token in Git URLs, exec input, shell history or environment files. Until a secure guest workflow is available, use your own authorized Git or agent login. An agent workflow with this token will still need a secure way to deliver it to the sandbox. Push will require sandboxes:write and repositories:write, and will grant contents:write.