Identity and authentication

Native Cloudflare Access

The hosted default uses Cloudflare Access. The control and preview hostnames have separate applications/audiences; approved human identities and machine Service Auth have different policies. Public mode can expose selected anonymous source while sign-in remains protected.

Golf accepts runtime-verified Access identity and maps it to an already enrolled, active D1 account. Caller-supplied identity headers do not grant access. Access never auto-enrolls an account or creates repository grants. A platform/account role does not override current repository authority.

Machine Git and Golf CLI requests require their independently configured Access transport plus a scoped Golf credential. The native CLI uses GOLF_NATIVE_TOKEN, with paired GOLF_ACCESS_CLIENT_ID and GOLF_ACCESS_CLIENT_SECRET environment variables; incomplete pairs and redirects are refused. Keep credentials out of URLs and command arguments.

Local Golf username/password

The operator explicitly maps an existing Forgejo user and scoped token to a Golf account. The Golf password is separate, at least 15 characters, and stored as a salted Argon2id verifier. Native credentials stay encrypted server-side; the browser receives an opaque HttpOnly cookie.

Registration is disabled. Follow installation and the local account contract. Ordinary account administration, session revocation and password-confirmed account changes have explicit current-authority checks.

Browser OAuth

Optional Forgejo OAuth uses a confidential application with exact callback http://localhost:8080/auth/forgejo/callback in local development. Configure GOLF_FORGE_PUBLIC_URL, GOLF_FORGE_OAUTH_CLIENT_ID and GOLF_FORGE_OAUTH_CLIENT_SECRET privately, then apply the existing Compose configuration. Authorization uses single-use state/browser binding and S256 PKCE.

Read-only PAT bootstrap needs read:user and read:repository, plus underlying permissions. The CLI uses GOLF_FORGE_TOKEN or --token-stdin. Owner-issued GOLF_API_TOKEN is a separately scoped product credential, not a direct Git password.

Manage Golf sessions

Portable sessions have an absolute twelve-hour lifetime and survive service restarts. Secure remote origins require HTTPS and a host-only secure cookie. Source-session termination invalidates its delegated credentials. Provider PATs, OAuth consent and Git keys retain separate lifecycles.

Optional MFA and recovery slices have their own setup/evidence. Hosted customer IdPs, onboarding and Access seat economics remain production qualification. Never infer account linking from matching email addresses.