# Git permissions and scopes > The OAuth scopes and token permissions AI CodeOps asks for on GitHub, GitLab, Bitbucket, Gitea and Forgejo, what each is used for, and how to revoke access. Source: https://aicodeops.dev/docs/git/permissions-and-scopes · Last updated: 2026-10-18 AI CodeOps reaches your repositories through a Git connection you make in **Configure → Settings → Git Providers**. This page lists exactly what each connection asks for, what AI CodeOps does with it, and how to take access away. ## What AI CodeOps does with a connection With your token, AI CodeOps: - reads your user profile, to show which account is connected and to check the token when you connect it; - lists and searches the repositories you can access, with their branches, files, commits and pull requests (**Develop → Repositories**); - clones a project's repository so a session can work on it; - pushes a branch named `codeops/run-` and opens a pull request into the project's default branch; - merges a pull request when you merge it from the console. It doesn't create repositories, register webhooks, post commit statuses or comment on pull requests. ## OAuth scopes by host Choose **Connect** (or **Connect via OAuth** on GitLab) on a host's card to connect with OAuth. | Host | Scopes requested | What they're for | | -------------- | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | GitHub | `repo`, `read:user`, `user:email` | `repo`: read and write your repositories, including private ones, to clone, push branches and open and merge pull requests. `read:user`: show the connected account. `user:email` is requested but not used by the connection. | | GitLab | `api`, `read_user` | `api`: read repositories, push branches, open and merge merge requests. `read_user`: show the connected account. | | Bitbucket | Set by the platform's OAuth consumer | Bitbucket lists them on its consent screen. They're used for the same operations as above. | | Gitea, Forgejo | None in the request | The server's default for the OAuth app applies. | GitHub uses an OAuth app, not a GitHub App. OAuth for GitLab, Gitea and Forgejo works only against the server the platform's OAuth app is registered on (GitLab.com for GitLab). For any other server, connect with a token. If OAuth isn't set up, you see "… sign-in isn't set up on this server". ## Personal access tokens Every host's card has a token field: **or access token** (or **or access token (no OAuth app)** on GitHub and Bitbucket). Paste a token and choose **Connect with token**. For GitLab on your own server, Gitea and Forgejo, also enter the **Instance URL**. It must be the server's public https address. Private network addresses and `localhost` are refused unless the platform operator allows that host. The token needs to read your profile, read repositories, push branches, and create and merge pull requests: | Host | Token permissions | | -------------- | --------------------------------------------------------------------------------------------------------------------------- | | GitHub | A classic token with `repo`, or a fine-grained token with **Contents** and **Pull requests** set to read and write. | | GitLab | A personal, project or group access token with the `api` scope. Project and group tokens need the Developer role or higher. | | Gitea, Forgejo | Read and write on **repository**, and read on **user**. | | Bitbucket | Sent as a Bearer token. Tokens that need a username alongside them won't work; connect with OAuth instead. | When you connect, AI CodeOps checks the token by reading your profile. It doesn't check the token's scopes. A token that's too narrow connects, then fails when a session tries to push or open a pull request. "Token rejected — check the URL and key." means the URL or token is wrong. Tokens are not refreshed. When a token expires on your host, disconnect and connect again with a new one. Host guides: [GitHub](https://aicodeops.dev/docs/git/github), [GitLab](https://aicodeops.dev/docs/git/gitlab), [Bitbucket](https://aicodeops.dev/docs/git/bitbucket), [Gitea](https://aicodeops.dev/docs/git/gitea), [Forgejo](https://aicodeops.dev/docs/git/forgejo). ## Whose connection is used A connection belongs to the person who made it, not the workspace. Workspace roles still decide what each person can do with it. When a change is approved, its pull request is opened with the approver's connection for that host. When you merge from the console, your own connection is used. You can have one connection per host type. To switch to another account or server, disconnect first. ## How tokens are stored Tokens are encrypted at rest with AES-256-GCM. They are passed to Git as a request header, never written into the repository's URL or its Git configuration. ## Revoke access 1. Open **Configure → Settings** and scroll to **Git Providers**. 2. Choose **Disconnect** next to the account, then **Disconnect account** to confirm. 3. On your Git host, revoke the token, or the AI CodeOps app under your authorized applications. Step 3 matters: **Disconnect** removes the connection from AI CodeOps but doesn't revoke the token on your host. ## Next steps - [Create a project](https://aicodeops.dev/docs/projects) - [How AI CodeOps works](https://aicodeops.dev/docs/how-it-works) - [Troubleshooting](https://aicodeops.dev/docs/troubleshooting) ## Frequently asked questions ### Does disconnecting revoke the token on my Git host? No. Disconnect removes the connection from AI CodeOps. To revoke the token itself, revoke it or the app in your Git host's settings. ### Does AI CodeOps add webhooks to my repositories? No. It doesn't register webhooks, post commit statuses or comment on pull requests. ### Is signing in with GitHub the same as connecting GitHub? No. Sign-in only reads your profile and verified email. Repository access comes from the separate Git connection in Settings.