Skip to main content

🔐 Source Control Tokens

Every Early AI agent requires a valid TOKEN to interact with your source control platform.
This token enables the CLI to read files, create commits, and optionally post comments or summaries on pull requests.

This guide explains:

  • Which token types are supported
  • The required scopes or permissions
  • How to generate tokens for GitHub, Bitbucket, and GitLab

🎯 Purpose of the TOKEN​

All Early AI agents — including GitHub PR, CLI PR, Commit CLI, and Repo CLI — use the TOKEN for one or more of the following:

  • ✅ Reading repository contents
  • ✅ Pushing or committing generated test files
  • ✅ Reading or updating PR or commit metadata
  • ✅ Commenting or updating PR summaries (when applicable)

⚠️ Without a valid token, the agent cannot read code or push new test files.

🧩 GitHub Tokens​

The simplest and most compatible option.
Works across all CI/CD platforms (GitHub Actions, Jenkins, CircleCI, etc.).

Required scopes:

  • repo — full repository access (includes contents, pull requests, and commits)
  • read:packages — required if installing the CLI from GitHub Packages

Create one here:
https://github.com/settings/tokens/new?type=classic

Fine-Grained Personal Access Token (FGPAT)​

More secure and restricted to specific repositories.

Minimum required repository permissions:

  • Contents → Read & Write
  • Pull Requests → Read & Write (if PR operations are needed)
  • Metadata → Read

⚠️ Fine-grained tokens do not support GitHub Packages.
You’ll still need a classic PAT for the NPM_TOKEN used during CLI installation.
See NPM Authentication.

Create one here:
https://github.com/settings/personal-access-tokens/new

🪣 Bitbucket Tokens​

Bitbucket uses App Passwords instead of PATs.

Minimum required permissions:

  • Repositories → Read & Write
  • (Optional) Pull Requests → Read & Write, if using PR-based agents

Generate an App Password:

  1. Go to Bitbucket Settings → Personal Bitbucket Settings → App passwords
  2. Click Create app password
  3. Select:
    • ✅ Repositories → Read & Write
    • ✅ Pull requests → Read & Write (if needed)
  4. Save and use it as the TOKEN.

More info:
https://support.atlassian.com/bitbucket-cloud/docs/app-passwords/

🦊 GitLab Tokens​

GitLab uses Personal Access Tokens.

Minimum required scopes:

  • api — full access to project and repository APIs
  • read_repository — to read code
  • write_repository — to push generated test files

Create one here:
https://gitlab.com/-/profile/personal_access_tokens

🧭 SCM Compatibility Overview​

SCMToken TypeRequired Permissions / ScopesNotes
GitHubClassic PAT or FGPATrepo, read:packages or (contents, pull_requests, metadata)Classic PAT recommended for CLI installation
BitbucketApp PasswordRepositories: Read & Write, Pull Requests: Read & WriteUse for CLI PR or Commit agents
GitLabPersonal Access Tokenapi, read_repository, write_repositorySupported for Commit and Repo agents

📎 Related Topics​