> ## Documentation Index
> Fetch the complete documentation index at: https://docs.replit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Machine Identities for Maintaining Environments

> Understand which identity accesses your repositories during interactive work and background environment builds, and choose personal or workspace connections.

Use Repositories > Manage to check which Git access you have. Keep your personal sign-in separate from shared build access and credentials for external services.

## Choose the right Git access

* Personal account: Agent uses your authorized account for interactive code inspection, branch pushes, and pull or merge requests.
* Workspace connection(s): Background environment builds use the workspace's repository grants without relying on your personal chat session. Only workspace administrators can configure them.

GitHub grants use a GitHub App installation; GitLab grants use groups and selected projects. Follow [Install the Git Provider App](https://docs.replit.com/build/code/install-git-app.md) to connect or change shared access.

If a build cannot fetch a repository, check Workspace connection(s). If Agent cannot push your branch, check Personal account and your repository write permissions. Disconnecting one kind of access does not remove the other.

## External resources need a separate identity

Git access alone does not grant access to AWS, a secrets manager, or private packages. For an environment that repeatedly needs an external service, prefer workload identity federation where the provider supports it: an administrator establishes trust in the provider, then the running sandbox presents a short-lived Replit workload JWT for credential exchange. Limit provider-side audience, claims, roles, and resource permissions. Trust can be broader than a single sandbox if the provider policy uses a workspace-wide claim.

The [AWS and Infisical walkthroughs](https://docs.replit.com/build/code/adding-secrets-to-environments.md#reuse-external-secrets-and-resource-access) show concrete federation patterns and their trust boundaries. For a one-off credential needed only in your private chat, use [chat secrets](https://docs.replit.com/build/code/adding-secrets-to-environments.md#the-simplest-option-a-secret-for-this-chat) instead. You may commit reviewed helper scripts and non-secret configuration; credential values, issued JWTs, and exchanged tokens never belong in Git or a prebuilt image.

> [!NOTE]
>
> These early-access workflows and provider recipes should be reviewed against your organization's current settings. The AWS and Infisical examples are documentation recipes, not a claim that your cloud account or a live federation exchange has been tested.