Read-only API credentials
This portable contract describes its linked source snapshot. For current deployment instructions, use current installation, authentication and native Cloudflare guides. Historical receipts do not verify later builds.
Issue a Golf credential from Account → API credentials for CLI and local MCP reads without sharing your upstream Forgejo credential with that process. Both infrastructure tracks use the same authority checks.
Issue and use
Choose New API credential to open the inline editor, then enter a label and requested lifetime. Cancel closes the editor and discards its draft without issuing a credential. The default is one hour; supported requests are 60 seconds to twelve hours, capped by the issuing browser session's actual expiry. The inventory uses a compact table; search and sortable headers operate only on loaded rows, while Load more credentials requests another server page. Copy the secret when shown: it is returned only once. Dismissal, navigation and sign-out clear the browser's in-memory secret. It is not saved in browser storage or query caches.
Supply the credential through your secret manager as GOLF_API_TOKEN, or pipe it to an ordinary CLI read:
./bin/golf --api-token-stdin repo list
For local MCP, configure GOLF_API_TOKEN in the owner's protected process environment and launch ./bin/golf mcp. Stdin belongs to MCP messages; neither token-stdin flag is supported there. Tool arguments cannot select another credential or destination. Never put a literal credential in shell history, committed configuration or a command-line argument. API and Forgejo token inputs cannot be mixed.
API mode performs no login/logout or temporary session creation. Existing Forgejo PAT bootstrap remains available with GOLF_FORGE_TOKEN or --token-stdin.
Authority and revocation
A credential delegates only the current 21 CLI/MCP reads plus identity inspection. It cannot create repositories, manage sessions or credentials, log in/out, or call unreviewed future operations. Native Forgejo scopes and permissions still apply; Golf does not copy or expand the source provider grant.
The token expires no later than its source session. Signing out that session or revoking it invalidates all credentials issued from it. Signing in again does not revive them. Other live sessions are independent. Explicitly revoke an unwanted credential in the account page; repeat revocation is harmless. At most 100 currently usable credentials may exist per account.
If creation's response is lost, inspect the metadata list and revoke the unwanted entry. There is no secret recovery or automatic issuance retry. Labels, IDs and timestamps are owner-only metadata; the token digest never appears in the list.
Recovery and scope
Encrypted offline recovery preserves metadata/events while invalidating every restored source session. Old API credentials remain denied after fresh sign-in; issue a new credential from the new session. Provider reconciliation after backup remains the operator's responsibility.
This is a read-only authentication foundation, not long-lived service accounts, configurable scopes, an OAuth/device authorization server, remote MCP, ACP or qualification of Claude Code/Codex/OpenCode/Grok/Pi execution. See the product credential contract and qualification ledger.