# Repository access in a sandbox

Coming soon. Repository tokens are not available in production yet. Automatic private-repository login is not available yet.

## Use case: Codex or Claude Code on a private repository

Once available, you will request a short-lived token for one repository selected in your workspace’s GitHub App installation. Git, Codex and Claude Code currently need your own authorized login. Tools in the planned developer image will never be preauthenticated.

## Permissions

The repository will need to be selected in the workspace’s connected GitHub App installation, and the sandbox will need to be running in that workspace. Read will require sandboxes:write plus repositories:read. Push will require sandboxes:write plus repositories:write. An API key will need both permissions and will never exceed its creator’s current permissions.

## What push permits

Push access will grant contents:write, including deletion of branches and tags and creation of releases. Branch protection will still apply. Workflow-file updates will not be granted. Prefer read access when a task does not need to push.

## Protect the token

Tokens will normally expire in one hour. A token will work outside the sandbox until it expires. Never place tokens in Git remote URLs, shell commands, environment files or exec input. Automatic guest credential delivery is not available yet.

## Related pages and language

[Private repository example](https://runzivo.dev/docs/sandboxes-devx-example-repository/)

[Français (Canada)](https://runzivo.dev/docs/sandboxes-repositories-fr-ca/)

On this page and page tools