Git credentials

Git credentials let canette clone private repositories. They are scoped to a project and can be shared across all apps within it.

Credential typesCopy Anchor Link

GitHub AppCopy Anchor Link

The recommended approach for GitHub repositories. A cluster-wide GitHub App is configured by your canette admin and generates short-lived tokens on demand — no long-lived secrets stored per user. See GitHub App authentication for setup instructions.

PAT (Personal Access Token)Copy Anchor Link

Works with GitHub, GitLab, Gitea, and any HTTPS Git host. The token is encrypted at rest and injected into the build job via a .netrc file — it never appears in clone URLs or process arguments.

GitHub — create at github.com/settings/tokens Required scope: repo (classic) or Contents: read (fine-grained)

GitLab — create at your profile → Access Tokens Required scope: read_repository

SSH deploy keyCopy Anchor Link

Works with any Git host. The private key is stored encrypted; the known_hosts fingerprint is stored in plaintext.

Use SSH URLs for the app's Git URL: git@github.com:org/repo.git

Adding a credentialCopy Anchor Link

1. Open the project → Credentials tab → Add credential
2. Choose the type (PAT or SSH key)
3. Enter the token or paste the private key
4. Assign the credential to an app in the app settings

Rotating a credentialCopy Anchor Link

Delete the existing credential and create a new one with the updated value. Active deployments in progress are not affected.