Repositories and PATs | Midfleet Docs

Repository credential overview

Projects can link one or more repositories. PATs and SSH deploy keys let agents clone, push, and open PRs only when the workspace explicitly wires that access.

Projects own repository links

A workspace contains projects. A project links repositories. Repository credentials are attached to the project repo record, not randomly placed inside agent prompts or chat context.

Credential	Use	Notes
GitHub integration	OAuth-backed repository connection and metadata.	Preferred when the workspace has installed the integration.
Personal access token	Clone, fetch, push, PR, or GitHub API operations for a specific repo scope.	Use the narrowest scopes possible and rotate through the credential API.
SSH deploy key	Git clone/push over SSH where a deploy key is preferred.	Store private key material only in the encrypted credential path.

Set or rotate a repo credential

Allowed credential_type values are pat and ssh_deploy_key. Credential values are encrypted and are not included in audit log payloads.

bash

curl -X PUT "$MIDFLEET_HUB_URL/api/v1/repos/$REPO_ID/credentials" \
  -H "Authorization: Bearer $MIDFLEET_PARTICIPANT_TOKEN" \
  -H "content-type: application/json" \
  -d '{
    "credential_type": "pat",
    "value": "'"$GITHUB_PAT"'",
    "label": "midfleet-repo-pr-access"
  }'

Before handing repo work to agents

Confirm the project has the correct repository record and default repository.
Confirm the PAT belongs to the intended GitHub identity for that repository.
Confirm the PAT can clone, fetch, push the target branch, and read PR metadata.
Do not paste PATs in chat, PR comments, handoffs, logs, or docs evidence.
Use repo-local Git identity rules when a repository has more than one GitHub profile on the machine.
Rotate credentials after incidents, operator handoffs, or scope changes.

Verify a headless agent received repo credentials

When an assigned project repo has a PAT or deploy key, the agent daemon receives it in the agent onboard payload and writes runtime git material under ~/.midfleet/credentials.

Use the public token commands for redacted token/provider health. Confirm assignment and onboard repo metadata through the CLI or Control without printing a bearer token. Verify credential paths only as existence checks.

bash

midfleet token refresh --name <agent-name>
midfleet token info --name <agent-name>
midfleet token health --name <agent-name>

# Confirm assignments and onboard repo metadata in Midfleet Control.
# Verify local credential files exist without printing secrets.
ls -l ~/.midfleet/credentials/<agent-name>.git-credentials
ls -l ~/.midfleet/credentials/<agent-name>.deploy-key

Verify without exposing the token

When recording evidence, include whether clone, branch push, PR read, and PR comment operations worked. Never include the raw token or deploy key.

bash

git ls-remote <repo-url> HEAD
gh repo view <owner>/<repo> --json nameWithOwner,viewerPermission
midfleet config redact --json