Connecting Git

deploybase pulls source code from Git repositories to build deployments. There are two ways to give it access.

GitHub: connect the App (recommended)

For GitHub you do not create a token at all. In the New Project wizard, press Connect GitHub, install the deploybase App, and choose which repositories it may see. Builds then authenticate with a short-lived installation token that deploybase mints per build and never stores.

This is a team-level connection, so it covers every GitHub project on the team, and it grants webhook access, which means auto-deploy and PR previews work with nothing extra to configure. Revoke it from GitHub, or from Adjust GitHub App access in the repository picker, at any time.

The rest of this page covers the token route, which is what GitLab, Bitbucket, Codeberg and self-hosted Git use. A GitHub project can also use a token if you prefer: when a project has one, it takes precedence over the App connection.

Supported Providers

Provider	Clone URL Format	Token Type
GitHub	https://github.com/user/repo.git	Personal access token (classic) or fine-grained
GitLab	https://gitlab.com/user/repo.git	Project or personal access token
Bitbucket	https://bitbucket.org/user/repo.git	App password
Codeberg	https://codeberg.org/user/repo.git	Application token

Configuration

Set the Git fields when creating or updating a project:

curl -X PATCH https://api.deploybase.eu/api/v1/projects/PROJECT_ID \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "git_repo_url": "https://github.com/user/repo.git",
    "git_provider": "github",
    "git_token": "ghp_xxxxxxxxxxxx",
    "default_branch": "main"
  }'

Field	Description
git_repo_url	HTTPS clone URL. SSH URLs are not supported.
git_provider	One of: github, gitlab, bitbucket, codeberg
git_token	Access token with read permissions on the repository. Stored encrypted.
default_branch	Branch that auto-promotes to production on deploy. Default: main

Validating Credentials

Before saving, verify that deploybase can access the repository:

curl -X POST https://api.deploybase.eu/api/v1/projects/validate-git \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "git_repo_url": "https://github.com/user/repo.git",
    "git_provider": "github",
    "git_token": "ghp_xxxxxxxxxxxx"
  }'

Returns {"valid": true} on success, or a git_error_code explaining the failure (authentication, not found, etc.).

Token Permissions

Read access (required for all projects)

Provider	Token Type	Required Permission
GitHub (fine-grained)	Fine-grained PAT	Contents: Read on target repo
GitHub (classic)	Classic PAT	repo scope (or public_repo for public repos)
GitLab	Project access token	read_repository scope
GitLab	Personal access token	read_api scope
Bitbucket	App password	Repositories: Read
Codeberg	Application token	repository read access

Auto-deploy (webhooks)

Enabling auto-deploy requires additional permissions to create and manage webhooks:

Provider	Token Type	Additional Permission Needed
GitHub (fine-grained)	Fine-grained PAT	Webhooks: Read & write on target repo
GitHub (classic)	Classic PAT	Already covered by repo scope
GitLab	Project access token	api scope (includes webhooks)
GitLab	Personal access token	api scope (not just read_api)
Bitbucket	App password	Webhooks: Read and write
Codeberg	Application token	write:repository scope

Without these permissions, git validation will succeed but webhook registration will fail when auto-deploy is enabled.

Codeberg tokens can’t be scoped to a single repository

Codeberg (and other Forgejo/Gitea instances) scope application tokens by capability — read:repository, write:repository — not by repository. There is no way to limit a token to one repo the way GitHub’s fine-grained PATs allow.

This means enabling auto-deploy on Codeberg requires a write:repository token that can manage webhooks across all repositories your account can access. If you’d rather not grant that, use a read-only repository token for cloning and skip auto-deploy — or trigger deploys another way.

Private Repositories

Private repositories work identically to public ones — provide a token with read access. The token is used only during git clone at build time and is never exposed in build logs.