Documentation
Repository access in a sandbox
Coming soon. The repository token API is switched off. Automatic private-repository login is not available yet.
Use case: Codex or Claude Code on a private repository
Once enabled and connected, repository access will let you work on an authorized repository from a sandbox. Git, Codex and Claude Code currently need your own authorized login. Tools in the developer image are never preauthenticated.
Permissions
The repository must be selected in the workspace’s connected GitHub App installation, and the sandbox must be running in that workspace. Read needs sandboxes:write plus repositories:read. Push needs sandboxes:write plus repositories:write. An API key needs both permissions and never exceeds its creator's current permissions.
What push permits
Push access grants contents:write, including deletion of branches and tags and creation of releases. Branch protection still applies. Workflow-file updates are not granted. Prefer read access when a task does not need to push.
Protect the token
Tokens normally expire in one hour. A holder can use one outside the sandbox until it expires. Never place tokens in Git remote URLs, shell commands, environment files or exec input. Automatic guest credential delivery is not available yet.