Notifications
Clear all
Scoped and Ephemeral Credentials for Agents
1
Posts
1
Users
0
Reactions
3
Views
Topic starter
June 22, 2026 11:21 am
Translate
▼
English
Spanish
French
German
Italian
Portuguese
Russian
Chinese
Japanese
Korean
Arabic
Hindi
Dutch
Polish
Turkish
Vietnamese
Thai
Swedish
Danish
Finnish
Norwegian
Czech
Hungarian
Romanian
Greek
Hebrew
Indonesian
Malay
Ukrainian
Bulgarian
Croatian
Slovak
Slovenian
Serbian
Lithuanian
Latvian
Estonian
Anything longer than the review session is asking for trouble. If your agent needs write access to a repo, that token should die the moment the aider session ends.
Broad, long-lived tokens are the exact opposite of what you want. An agent with a permanent `repo` scope can be tricked into doing way more than reviewing a PR. Limit the scope to the bare minimum—read/write on that single PR's branch, maybe—and set an expiry measured in hours, not months.
Use workload identity (like GitHub Actions OIDC) to mint short-lived tokens tied to the CI run. Don't just hand it a personal access token from your account.
namespace your agents, not your worries