Skip to main content
Use Repositories > Manage to check which Git access you have. Keep your personal sign-in separate from shared build access and credentials for external services.

​
Choose the right Git access

  • Personal account: Agent uses your authorized account for interactive code inspection, branch pushes, and pull or merge requests.
  • Workspace connection(s): Background environment builds use the workspace’s repository grants without relying on your personal chat session. Only workspace administrators can configure them.
GitHub grants use a GitHub App installation; GitLab grants use groups and selected projects. Follow Install the Git Provider App to connect or change shared access. If a build cannot fetch a repository, check Workspace connection(s). If Agent cannot push your branch, check Personal account and your repository write permissions. Disconnecting one kind of access does not remove the other.

​
External resources need a separate identity

Git access alone does not grant access to AWS, a secrets manager, or private packages. For an environment that repeatedly needs an external service, prefer workload identity federation where the provider supports it: an administrator establishes trust in the provider, then the running sandbox presents a short-lived Replit workload JWT for credential exchange. Limit provider-side audience, claims, roles, and resource permissions. Trust can be broader than a single sandbox if the provider policy uses a workspace-wide claim. The AWS and Infisical walkthroughs show concrete federation patterns and their trust boundaries. For a one-off credential needed only in your private chat, use chat secrets instead. You may commit reviewed helper scripts and non-secret configuration; credential values, issued JWTs, and exchanged tokens never belong in Git or a prebuilt image.
These early-access workflows and provider recipes should be reviewed against your organization’s current settings. The AWS and Infisical examples are documentation recipes, not a claim that your cloud account or a live federation exchange has been tested.