Skip to content

Managing GitHub Tokens for Muppy

New here? Git workflows in Muppy explains the model in one page — why it works this way, and which tokens to create.

GitHub works with Muppy: store a token as a Git PAT vault and the credential helper serves it exactly as it does on any other provider. What is documented below is the part that differs from GitLab, which is where the click-paths live for now.

The GitHub workflow
Can Muppy cancel an authorization here? There is none to cancel. Muppy does not use an OAuth application on GitHub: access is by personal access token, which you create and revoke at GitHub yourself.
Can a token describe itself? Partly, and it depends on the kind. Introspect token always learns whether the token is alive, who owns it and when it expires. A classic token also reports its scopes, so Muppy corrects Access level and sets Token scope to account-wide. A fine-grained token reports nothing about its reach — that field stays exactly what you typed. github.com only.
Do tokens expire? Classic PATs may be created without one; fine-grained ones always carry one. Introspect token reads the real expiry from GitHub and fills it in.
The trap On a fine-grained token your declaration is never corrected. Record it as read-only and limited to one repository when it is neither, and Muppy serves it on your word — with no approval window. A classic token is caught the next time you check it; a fine-grained one never is.

Checking a token works on github.com only

Introspect token is not offered on a GitHub Enterprise Server. Enterprise puts its API at a different address and Muppy has never been run against one, so it says nothing rather than call an address it guessed. On Enterprise, both Access level and Token scope are yours to keep accurate, whichever kind of token you created.

Creating the tokens

Settings → Developer settings → Personal access tokens.

Choose Fine-grained tokens and limit the token to the single repository the box needs, with Contents: Read-only — that is GitHub's equivalent of the repo-scoped read-only token Muppy serves without an approval window. Use Read and write for a token that will push, and record the same in the vault's Access level.

Store it in Muppy as a Git PAT vault, and set Access level and Token scope yourself: on this provider they are a declaration, not a measurement.

What Muppy can and cannot do for you here
Check what a token really is Partly. Alive, owner and expiry for any token. Scopes and reach for a classic one. Nothing about which repositories a fine-grained token covers — GitHub has no endpoint that reports it.
Show your tokens so you can pick one No. GitHub has no endpoint listing the tokens you hold, so Link Git Token is not offered here.
Cancel a Muppy authorization Nothing to cancel — Muppy holds no connection on GitHub. Revoke the token at GitHub when you are done with it.

See also