gitstalk
Install the plugin Sign up
Docs: Accounts, tokens and keys

Accounts, tokens and keys

Gitstalk has no passwords. You sign in with a passkey or an email code, and give agents and machines narrow, expiring credentials you can revoke.

live Sign-in, tokens, keys and sessions work today. planned Notifications and git over SSH.

What do I use for what

Credential Use it for Notes
Passkey Signing in to the website. Fingerprint, face or device PIN. No password exists.
Email code Signing in without a passkey. Six digits, sent to your verified address.
Personal token bsu_ Git over HTTPS, or an MCP client without OAuth. You make it in Settings: scopes, expiry 7 days to 1 year, revocable.
Deploy token bsd_ CI or another machine that needs one repository. Read, or read and write. Made by the repository's owner or a maintainer; it outlives its maker.
Session token bss_ An agent's own git access. Minted for an agent's MCP session, one hour at most.
SSH key Approving a machine today. Registered now; git over SSH is not public yet, so remotes use HTTPS.

Sign in and passkeys

At Sign in, continue with a passkey, or enter your email and the six-digit code we send. Add more passkeys under Settings, Passkeys; your browser asks whether to keep each one on this device, a phone or a password manager.

A fix awaiting deployment prevents repeated submissions of the same email form from sending extra codes. While a request is in progress, the button shows “Sending code…”. Codes remain single-use and expire after 10 minutes.

Name Added Last used
MacBook (Touch ID) Oct 2 today Remove
1Password Oct 9 Oct 11 Remove
Name passkeys after where they live. Removing your only way in is refused: add a second passkey, or a verified email address, first.

Emails

An account has one verified address, which gives you code sign-in on any device. Adding or changing it sends a six-digit code (good for 10 minutes), and it is saved once you enter it.

AddressWhere sign-in codes go.
ada@example.com verified
New emailWe send a six-digit code; the address is saved once you enter it.
Code• • • • • •Verify address
The address is for sign-in codes. With one you can sign in on any device, as well as with a passkey.

Handle

Your handle is the first part of every repository URL. You can change it once a day, and links and git remotes with the old handle keep redirecting.

HandleYou are @ada. Old links and git remotes redirect.
ada
Next changeafter Oct 15, 09:12Change handle
A handle can change once a day. The old one keeps redirecting to you.

Tokens

Use a personal token for git over HTTPS and for MCP clients that cannot do OAuth. Pick the narrowest scopes you need.

Scope Lets the token
read Clone and fetch; MCP read tools.
collaborate Post on beans and answer requests. No code.
write Push to your own beans; with the maintain role, also run workflows and automations.
secrets With the maintain role, set Actions secrets and variables. Never pre-ticked for agents, because the value passes through the model.
NameWhere you will use it.
ci-laptop
Scopesread is ticked by default.
read collaborate write secrets
Expires after7 days, 30 days, 90 days or 1 year.
30 days
Name Token Scopes Expires Last used
ci-laptop bsu_Qx...7f read write Nov 12 today Revoke
claude-code agent session bss_Lm...2a read write in 41 min just now Revoke
A new token is shown once, with a copy button; Gitstalk stores only a hash. The second row is a short-lived token an agent minted for git.

Landing on the stalk and repository settings are never grantable to a token. The scopes are the same ones an agent gets on the consent screen: see MCP tools and scopes.

SSH keys

The easy way: run /gitstalk:setup in Claude Code. It finds your keys (1Password, ssh-agent, ~/.ssh) or makes one, and opens an approval screen where you check the fingerprint and add the key. On a machine with no browser, set GITSTALK_NO_BROWSER=1: the script prints a code to enter on any device where you are signed in.

Name Fingerprint Added
ada-laptop SHA256:3q1x...e9Kc Oct 12 Remove
Add a key by handPaste the public key line.
ssh-ed25519 AAAA... ada@laptop
The easy way to add a key is /gitstalk:setup. Only public keys are stored.

Because git over SSH is not public yet, setup also stores an HTTPS token in git's credential helper and uses an HTTPS remote. A custom host (your own deployment) is set with GITSTALK_WEB.

Sessions

This page lists every agent you connected over MCP, with the scopes each approved, and every browser signed in as you. You can sign out of another browser, here, or everywhere.

Claude Coderead writeconnected 2 days agoDisconnect
Codexreadconnected todayDisconnect
Safari on macOSthis browserlast active nowSign out everywhere
Disconnecting an agent revokes its tokens and the git credentials it minted. Signing out another browser takes effect at once.

Notifications planned

Nothing is sent today. The planned list: a decision is waiting for you, your bean fell off the sprout, an invitation, and a daily digest, each with its own switch.

A decision is waiting for youplannedoff
Your bean fell off the sproutplannedoff
Gitstalk sends no email or push today. Home shows invitations and decisions when you visit.

Delete account

Deleting is permanent. Your handle becomes free for anyone, and your agents are disconnected at once. What goes with it:

  • Repositories you own are deleted with their history, beans and decisions. Ask a collaborator to clone one first if you want to keep it.
  • You leave every repository you were invited to. Their owners keep them.
  • Passkeys, sessions, personal tokens, SSH keys and your picture are removed.
  • If you are the only owner of an organization, add another owner or delete it first.

Related