Personal Access Tokens
Complete step-by-step guide to create and configure Personal Access Tokens (PAT) for GitHub, GitLab and Bitbucket
📖 Introduction
Welcome to the Mindus Forge Token Setup Guide. This comprehensive documentation will walk you through the process of creating Personal Access Tokens (PAT) for GitHub, GitLab, and Bitbucket. These tokens are essential for Mindus Forge to create repositories and push code on your behalf.
Unlike OAuth authentication which may have limited permissions, Personal Access Tokens give you full control over exactly what access you grant. This guide will help you create tokens with the minimum required permissions for Mindus Forge to function properly.
🔐 What is a Personal Access Token?
A Personal Access Token (PAT) is an alternative to using your password for authenticating to GitHub, GitLab, or Bitbucket when using the API or command line. Think of it as a secure, revocable password that you can create for specific applications like Mindus Forge.
PATs are superior to regular passwords for API access because:
- Fine-grained permissions: You can give exactly the access needed (e.g., only repository access, not account management)
- Revocable: If a token is compromised, you can revoke it without changing your password
- Expiration dates: You can set tokens to expire automatically after a certain period
- Auditable: You can see when and where each token was last used
💡 Pro Tip: Always create separate tokens for different applications. This way, if one application is compromised, you only need to revoke that specific token.
🐙 GitHub Personal Access Token
Platform: GitHub · Type: Personal Access Token (Classic)
Step-by-Step Instructions
Go to GitHub Settings → Developer settings → Personal access tokens → Tokens (classic)
Click Generate new token (classic) and authenticate if prompted.
Enter a descriptive name like Mindus Forge so you can identify it later.
Choose an expiration date. We recommend 90 days or 1 year. You can always create a new token when it expires.
You MUST select the following scopes for Mindus Forge to work properly:
- ✅ repo (ALL sub-options) - This grants full control of repositories
- ✅ workflow - Allows updating GitHub Action workflows (optional but recommended)
⚠️ Critical: Without the repo scope, Mindus Forge CANNOT create repositories or push code. Make sure to expand the "repo" section and check ALL sub-options.
Click Generate token at the bottom. IMPORTANT: Copy the token immediately! GitHub will only show it once.
🔐 The token looks like: ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Go to Settings → Personal Access Tokens in Mindus Forge, paste your token, and click "Save Token".
🦊 GitLab Personal Access Token
Platform: GitLab · Type: Personal Access Token
Step-by-Step Instructions
Go to GitLab User Settings → Access Tokens
Enter a token name like Mindus Forge.
Choose an expiration date (recommended: 1 year).
Select the following scopes:
- ✅ api - Grants complete read/write access to the API
- ✅ write_repository - Allows pushing code to repositories
- ✅ read_repository - Allows reading repositories (required for some features)
Click Create personal access token. Copy the token immediately - it won't be shown again!
Go to Settings → Personal Access Tokens in Mindus Forge, paste your token, and click "Save Token".
🪣 Bitbucket App Password
Platform: Bitbucket · Type: App Password
Step-by-Step Instructions
Go to Bitbucket Account Settings → App Passwords
Click Create app password.
Enter a label like Mindus Forge.
Select the following permissions:
- ✅ Account → Read
- ✅ Projects → Read
- ✅ Repositories → Read and Write
- ✅ Pull Requests → Read and Write (optional)
Click Create. Copy the generated password immediately - it won't be shown again!
Go to Settings → Personal Access Tokens in Mindus Forge, paste your App Password, and click "Save Token".
📋 Scopes Explained
Scopes are permissions that define what actions a token can perform. Here's what each scope means for Mindus Forge:
GitHub Scopes
| Scope | Required | Purpose |
|---|---|---|
| repo | ✅ Yes | Full control of repositories - allows creating, reading, and pushing code |
| repo:status | ✅ Yes | Access commit status (part of repo scope) |
| repo_deployment | ✅ Yes | Access deployments (part of repo scope) |
| public_repo | ✅ Yes | Access public repositories (part of repo scope) |
| repo:invite | ✅ Yes | Access repository invitations (part of repo scope) |
| workflow | ⭐ Optional | Update GitHub Action workflows |
GitLab Scopes
| Scope | Required | Purpose |
|---|---|---|
| api | ✅ Yes | Full API access - required for repository operations |
| write_repository | ✅ Yes | Push code to repositories |
| read_repository | ✅ Yes | Read repository contents |
Bitbucket Scopes
| Permission | Required | Purpose |
|---|---|---|
| Account → Read | ✅ Yes | Identify your account |
| Repositories → Read | ✅ Yes | List and read your repositories |
| Repositories → Write | ✅ Yes | Push code to repositories |
| Pull Requests → Read/Write | ⭐ Optional | Create pull requests automatically |
🛡️ Security Best Practices
⚠️ Critical Security Guidelines:
- Never share your tokens - Treat them like passwords
- Don't commit tokens to git - Never hardcode tokens in your code
- Use environment variables - Store tokens in environment variables or secure vaults
- Set expiration dates - Always set an expiration date for your tokens
- Use minimum required scopes - Only grant permissions that are absolutely necessary
- Regularly rotate tokens - Create new tokens and delete old ones every few months
- Revoke unused tokens - Immediately revoke tokens you no longer need
- Monitor token usage - Check when and where your tokens are being used
🔐 What to do if a token is compromised:
1. Immediately revoke/delete the compromised token on the platform
2. Create a new token with the same scopes
3. Update the token in Mindus Forge Settings
4. Review recent activity on your account
🔧 Troubleshooting
Common Issues and Solutions
This means your token doesn't have the repo scope. Delete the token and create a new one with ALL repo sub-options selected.
Your token is invalid or expired. Create a new token and update it in Mindus Forge Settings.
Your token doesn't have permission to create repositories. Verify that the repo scope is selected for GitHub, or write_repository for GitLab.
Click the "Refresh All" button in Settings. If it still doesn't appear, try deleting and re-adding the token.
❓ Frequently Asked Questions
Why do I need a Personal Access Token?
Mindus Forge needs permission to create repositories and push code on your behalf. A PAT gives us exactly the permissions needed without exposing your password.
Can I use OAuth instead?
OAuth is available for login, but it may have limited permissions. For full functionality (creating repositories, pushing code), a PAT with the correct scopes is required.
How often should I rotate my tokens?
We recommend rotating tokens every 90 days for optimal security. Set expiration dates when creating tokens to automate this process.
What happens if my token expires?
When your token expires, Mindus Forge will no longer be able to push code. Simply create a new token and update it in Settings.
Can I use the same token for multiple platforms?
No. Each platform (GitHub, GitLab, Bitbucket) requires its own separate token. Create one for each platform you want to use.
Is my token stored securely?
Yes. All tokens are encrypted in our database and never exposed in logs or API responses.
🚀 Next Steps
Now that you've created your Personal Access Tokens, here's what you can do next:
💡 Need help? Contact our support team at support@mindusforge.com or join our Discord community for real-time assistance.
Mindus SAS – 12 rue de la Fonderie, 75011 Paris – RCS Paris 912 345 678 – VAT FR23912345678
Documentation Version: 1.0.0 | Last updated: June 4, 2026