| 1 | --- |
| 2 | title: Workspaces |
| 3 | description: Workspaces, their names and icons, renaming and deleting one, members, owners and the roles that add to a member, member privileges, requiring two-factor authentication, and access tokens that belong to a workspace. |
| 4 | --- |
| 5 | |
| 6 | A workspace owns repositories and is the first part of their address: |
| 7 | `g1t.sh/<workspace>/<repo>`. There is one kind. A workspace for just you and |
| 8 | one for a company are the same thing with a different number of members, so |
| 9 | there is no separate notion of an organization. |
| 10 | |
| 11 | ## Create a workspace |
| 12 | |
| 13 | Your account does not own repositories itself: a workspace does, and |
| 14 | repositories go in it. Every new account gets a workspace of its own, named |
| 15 | for its username and on the free plan, unless its invite brings it into |
| 16 | someone else's workspace; see |
| 17 | [your first workspace](/guides/authentication/#your-first-workspace). |
| 18 | Signed in without a workspace, g1t shows **Create your workspace or ask to |
| 19 | join one** in place of Mission control: the invitations waiting for you, |
| 20 | and the form below. |
| 21 | |
| 22 | To create another: |
| 23 | |
| 24 | 1. Open [g1t.sh/workspaces/new](https://g1t.sh/workspaces/new). |
| 25 | 2. Choose its name in URLs: lowercase letters, digits and single hyphens. |
| 26 | An owner can [change it later](#rename-a-workspace), and old addresses |
| 27 | redirect for 90 days. |
| 28 | 3. Optionally give it a display name. |
| 29 | |
| 30 | From the API, `POST /workspaces` with `slug` and `name`, or the |
| 31 | `workspace` tool's `create` action: |
| 32 | |
| 33 | ```sh |
| 34 | curl -X POST https://api.g1t.sh/workspaces \ |
| 35 | -H "Authorization: Bearer $G1T_TOKEN" \ |
| 36 | -H "Content-Type: application/json" \ |
| 37 | -d '{"slug": "acme", "name": "Acme"}' |
| 38 | ``` |
| 39 | |
| 40 | You can belong to up to ten workspaces. `GET /user`, or the `account` tool's `whoami` action, lists the |
| 41 | ones you belong to. |
| 42 | |
| 43 | A new workspace is free, and **each person can own one free workspace**. |
| 44 | While you own a free workspace, the page shows **You already own a free |
| 45 | workspace** in place of the form, with **Start the plan** on it; the API |
| 46 | answers `402` (`payment_required`). Start the plan on it, or delete it, |
| 47 | then create the new one. Several free workspaces from before are kept, but |
| 48 | each needs the plan (or deleting) before you can create another. See |
| 49 | [one free workspace per person](/guides/usage-and-billing/#one-free-workspace-per-person). |
| 50 | |
| 51 | Usernames and workspaces share one set of names, so a name means the same |
| 52 | thing wherever it appears. Your username is reserved for you: only you can |
| 53 | create a workspace with that name, and nobody can register a username that |
| 54 | is already a workspace. The names `g1t` and `g1t-agent` belong to |
| 55 | [g1t's agent](/guides/working-with-g1t/), and nobody can register them. |
| 56 | |
| 57 | ## Display name, slug and icon |
| 58 | |
| 59 | A workspace has two names: |
| 60 | |
| 61 | | | Example | Where it appears | Changes | |
| 62 | | --- | --- | --- | --- | |
| 63 | | **Display name** | `Flagon Industries` | The sidebar, the top of its page, mission control and link previews | Any time, up to 80 characters; spaces and capitals are fine | |
| 64 | | **Slug** | `flagon` | Every address: `g1t.sh/flagon/<repo>`, clone URLs, API paths and `g1t.page` app addresses | By an owner, once a day at most; the old one redirects for 90 days. See [rename a workspace](#rename-a-workspace) | |
| 65 | |
| 66 | Without a display name, the slug is shown. Where an address is shown, the |
| 67 | slug is in monospace beside the name. Owners change the display name and |
| 68 | description (up to 160 characters) on **Settings → General**, or with |
| 69 | [`PATCH /workspaces/{workspace}`](/reference/api/workspaces/update-workspace/) |
| 70 | (MCP: `workspace` `update`), which takes `name` and `description` and |
| 71 | changes only the fields given. It needs the `workspace:admin` scope, and |
| 72 | is recorded in the [audit log](/guides/audit-log/): |
| 73 | |
| 74 | ```sh |
| 75 | curl -X PATCH https://api.g1t.sh/workspaces/flagon \n -H "Authorization: Bearer $G1T_TOKEN" \n -H "Content-Type: application/json" \n -d '{"name": "Flagon Industries", "description": "Rockets, and the software that flies them."}' |
| 76 | ``` |
| 77 | |
| 78 | Neither changes the slug; that is a [rename](#rename-a-workspace). |
| 79 | |
| 80 | A workspace also has an icon. Without |
| 81 | one, g1t draws its first letter in a colour of its own. To upload one, an |
| 82 | owner opens **Settings → General** and picks an image: |
| 83 | |
| 84 | - PNG, JPEG, WebP or GIF, at most 1 MB. Square images look best. |
| 85 | - An image is checked by its contents, not its name. SVG is refused, |
| 86 | because it can carry script. |
| 87 | - **Remove** goes back to the letter. |
| 88 | |
| 89 | The icon then shows wherever the workspace does, and on its link previews |
| 90 | (PNG and JPEG icons only). Each image is served from |
| 91 | `g1tusercontent.com/avatars/<sha256>`, an address named after its contents, so an icon |
| 92 | that changes gets a new address and nothing shows the old one. |
| 93 | |
| 94 | You can upload a picture of yourself the same way, under |
| 95 | [Settings → Profile](https://g1t.sh/settings/profile). |
| 96 | |
| 97 | ## Rename a workspace |
| 98 | |
| 99 | Renaming changes the slug, the first part of every address under the |
| 100 | workspace. The display name is separate; change it on its own under |
| 101 | **Settings → General → Workspace details**. Only owners can rename a |
| 102 | workspace. |
| 103 | |
| 104 | 1. Open the workspace's **Settings → General** and go to **Address**. |
| 105 | 2. Type the new slug. The field shows the new address, `g1t.sh/<new>`, and |
| 106 | whether the name is available. |
| 107 | 3. Choose **Change address**, read what changes, type the new slug to |
| 108 | confirm, and choose **Change address** again. |
| 109 | |
| 110 | You land on the workspace's settings at its new address. Repositories, |
| 111 | issues and the rest move with it within a few seconds. |
| 112 | |
| 113 | ### What changes |
| 114 | |
| 115 | | | Before | After | |
| 116 | | --- | --- | --- | |
| 117 | | Pages | `g1t.sh/old/<repo>` | `g1t.sh/new/<repo>` | |
| 118 | | Git remotes | `https://g1t.sh/old/<repo>.git` | `https://g1t.sh/new/<repo>.git` | |
| 119 | | API paths | `https://api.g1t.sh/repos/old/<repo>` | `https://api.g1t.sh/repos/new/<repo>` | |
| 120 | | MCP tool arguments | `"owner": "old"` | `"owner": "new"` | |
| 121 | | Production apps | `https://<project>-old.g1t.page` | `https://<project>-new.g1t.page` | |
| 122 | | Previews | `https://<project>-git-<branch>-old.g1t.page` | `https://<project>-git-<branch>-new.g1t.page` | |
| 123 | |
| 124 | These stay the same: the display name, description and icon, members and |
| 125 | roles, access tokens, secrets and variables, integrations, webhooks, |
| 126 | issues and pull requests, and billing, plans and credit. |
| 127 | |
| 128 | ### What redirects, and for how long |
| 129 | |
| 130 | For 90 days after a rename, the old name keeps working: |
| 131 | |
| 132 | | | Behaviour | |
| 133 | | --- | --- | |
| 134 | | Web pages | Answer with a permanent redirect (301) to the same page under the new name, query string included. | |
| 135 | | `git clone`, `fetch`, `pull` and `push` | Redirected to the new remote. Git follows it, but prints a warning each time until you update the remote. | |
| 136 | | API and MCP | A call that names the old slug runs under the new one. | |
| 137 | | `g1t.page` apps | Production and preview addresses under the old name redirect to the new ones. | |
| 138 | |
| 139 | Update your remotes now rather than relying on the redirect: |
| 140 | |
| 141 | ```sh |
| 142 | git remote set-url origin https://g1t.sh/<new>/<repo>.git |
| 143 | ``` |
| 144 | |
| 145 | Update anything else that has the old name written into it, too: links in |
| 146 | READMEs and docs, CI configuration, API clients and MCP clients. |
| 147 | |
| 148 | ### Limits |
| 149 | |
| 150 | - A workspace can be renamed once every 24 hours. |
| 151 | - For 90 days the old name is held for the workspace. Nobody else can take |
| 152 | it, and you can rename back to it. |
| 153 | - After 90 days the redirects stop, and anyone can create a workspace or |
| 154 | register a username with the old name. Links and remotes that still use |
| 155 | it then reach whatever has the name, or nothing. |
| 156 | - The new name follows the same rules as a new workspace: lowercase letters, |
| 157 | digits and single hyphens, up to 39 characters, not a reserved word, and |
| 158 | not another workspace's slug or someone else's username. |
| 159 | |
| 160 | ## Data residency |
| 161 | |
| 162 | Data residency says where the git data of the workspace's new repositories |
| 163 | is stored. The section appears in **Settings** once g1t can store |
| 164 | repositories in the EU. Until then it is not shown, and every repository is |
| 165 | stored wherever g1t stores repositories. |
| 166 | |
| 167 | | Setting | What it does | |
| 168 | | --- | --- | |
| 169 | | Anywhere | New repositories are stored wherever g1t stores repositories. The default. | |
| 170 | | EU only | New repositories are stored in the EU. If EU storage cannot take one right now, the repository is not made, and you are told why. It is never stored somewhere else instead. | |
| 171 | |
| 172 | To change it: |
| 173 | |
| 174 | 1. Open the workspace, then **Settings**. Only owners see the page. |
| 175 | 2. Under **Data residency**, choose **Anywhere** or **EU only**. |
| 176 | 3. Select **Save**. |
| 177 | |
| 178 | The setting applies to repositories made after you save it, however they |
| 179 | are made: from the site, with the API, by pushing to a new address, or by |
| 180 | importing. Repositories the workspace already has stay where they are. To |
| 181 | move them, contact support; a move keeps each repository's address, history |
| 182 | and settings, and pushes to it wait a few minutes while it happens. |
| 183 | |
| 184 | Data residency covers the git data: commits, branches, tags and files, |
| 185 | including pull requests' working copies, which are stored with their |
| 186 | repository. Issues, pull requests, comments and settings are not affected. |
| 187 | A repository [transferred](/guides/transferring-repositories/) to another |
| 188 | workspace stays where it is stored. |
| 189 | |
| 190 | Changing the setting is recorded in the |
| 191 | [audit log](/guides/audit-log/) as `workspace.residency_changed`. |
| 192 | |
| 193 | ## Delete a workspace |
| 194 | |
| 195 | Deleting a workspace takes everything in it with it, in one step: its |
| 196 | repositories, projects, apps, members' access and tokens. Only an owner can, |
| 197 | signed in as a person, typing the workspace's slug to confirm. |
| 198 | |
| 199 | It is not gone at once. For **30 days** g1t keeps all of it, so that a |
| 200 | deletion you did not mean, or did not make, can be undone: an owner writes |
| 201 | to support@g1t.sh, and support restores the workspace as it was. After 30 |
| 202 | days it is purged for good. |
| 203 | |
| 204 | 1. Open the workspace's **Settings → General** and go to **Danger zone**. |
| 205 | It lists what will go with the workspace: its repositories, projects, |
| 206 | live apps and members. |
| 207 | 2. Choose **Delete workspace**, read what happens, type the workspace's |
| 208 | slug to confirm, and choose **Delete workspace** again. You are taken |
| 209 | back to your own home. |
| 210 | |
| 211 | The one thing that can stand in the way is billing: see |
| 212 | [what billing needs](#what-billing-needs). Repositories you want to keep in |
| 213 | another workspace, [transfer](/guides/transferring-repositories/) first; |
| 214 | their old addresses keep redirecting after the workspace is gone. |
| 215 | |
| 216 | From the API, call |
| 217 | [`DELETE /workspaces/{workspace}`](/reference/api/workspaces/delete-workspace/) |
| 218 | with the slug in `confirm`; over MCP, the `workspace` tool's `delete` |
| 219 | action. |
| 220 | |
| 221 | Some workspaces can never be deleted, by anyone, such as Flagon's, which |
| 222 | runs g1t. Their Danger zone says so instead of offering the button. |
| 223 | |
| 224 | ### What billing needs |
| 225 | |
| 226 | | | | |
| 227 | | --- | --- | |
| 228 | | Money owed | Charged to the workspace's card at once, with no minimum charge. With no card, add one or pay from **Billing** first. | |
| 229 | | An unpaid invoice | Pay it from **Billing** first. | |
| 230 | | Prepaid credit | It would be lost: spend it, or write to support@g1t.sh about a refund, first. | |
| 231 | | Usage this month still being metered | Storage and git operations are charged when the month closes. You can delete the workspace from the 1st of next month. | |
| 232 | | The g1t plan | Ends at Stripe at once, not at the end of the period. | |
| 233 | | An enterprise account | A workspace billed through one is moved off it by g1t first: write to support@g1t.sh. | |
| 234 | |
| 235 | A comped workspace owes nothing; only its plan is ended. |
| 236 | |
| 237 | ### What happens |
| 238 | |
| 239 | At once, when an owner deletes it: |
| 240 | |
| 241 | | | | |
| 242 | | --- | --- | |
| 243 | | Members | Lose access, and the workspace leaves their list. Their own accounts are not touched: a person with no workspace left can still sign in, and create or join one. | |
| 244 | | Access tokens | The workspace's own tokens stop working. Personal tokens are not affected. | |
| 245 | | Repositories | Deleted with it: git refuses them, and their pages answer 404. Agents and workflow runs stop. Ones deleted on their own earlier stay deleted. | |
| 246 | | Projects and apps | Hidden. Its apps are taken offline and nothing builds. Custom domains are kept for a restore. | |
| 247 | | Its pages | Answer 404, and it drops out of search. | |
| 248 | | Billing | What it owes is charged, and its plan ends, as [billing needs](#what-billing-needs). Nothing more is charged. | |
| 249 | | The audit log | Records the deletion. | |
| 250 | |
| 251 | Within 30 days, support can restore it: its members, tokens, repositories, |
| 252 | projects and apps come back as they were, and its apps go back up as its |
| 253 | limit allows. Its plan does not come back by itself: an owner starts it |
| 254 | again from **Billing**. A repository deleted on its own before the |
| 255 | workspace was stays in **Recently deleted**. |
| 256 | |
| 257 | After 30 days it is purged: |
| 258 | |
| 259 | | | | |
| 260 | | --- | --- | |
| 261 | | Repositories | Purged, their git data with them, including any that were in Recently deleted. | |
| 262 | | Projects, apps and custom domains | Removed. | |
| 263 | | Webhooks, integrations, secrets and variables | The workspace's own are removed. | |
| 264 | | Memory and guardrails | The workspace's own are removed. | |
| 265 | | Statements, invoices and the ledger | Kept, for accounting. | |
| 266 | | The audit log | Kept as [long as its account keeps it](/guides/audit-log/#how-long-it-is-kept), with the purge as its last entry: once the plan ends with the workspace, that is 7 days, unless an enterprise pays for it or longer was arranged. With no owners left, ask support@g1t.sh for an export. | |
| 267 | | Old addresses | Redirects for repositories transferred out keep working. The workspace's own pages answer 404. | |
| 268 | |
| 269 | ### The name afterwards |
| 270 | |
| 271 | A deleted workspace's slug is never given to another workspace or used as |
| 272 | someone else's username. While it can still be restored, the slug is held |
| 273 | for it. Links and git remotes that still use it keep |
| 274 | meaning what they meant: a transferred repository's old address keeps |
| 275 | redirecting to it, and nobody can take the name in the meantime. |
| 276 | |
| 277 | The one exception: when the slug is your own username, you may create a |
| 278 | workspace with that name again once the old one is purged. It starts empty, on standard billing terms, |
| 279 | and a repository made in it at an old address ends that address's redirect. |
| 280 | |
| 281 | ## Members and roles |
| 282 | |
| 283 | <a id="members-and-owners"></a> |
| 284 | |
| 285 | | Role | Can | |
| 286 | | --- | --- | |
| 287 | | Member | Create repositories (as the [member privileges](#member-privileges) allow), see the workspace's usage and billing, and get the workspace's [base permission](/guides/access-and-roles/#the-base-permission) on every repository in it: Read for a new workspace, which an owner can raise to Write to let members push, merge pull requests, plan work and put g1t to work. Admin on the repositories they create. | |
| 288 | | Owner | Everything a member can, and manage members and owners, the base permission, the member privileges, two-factor requirement, the workspace's access tokens, its details, and billing: the plan, card checks, prepayment and limits. Admin on every repository, and the only ones who can transfer and delete them unless the member privileges allow admins; see [access and roles](/guides/access-and-roles/). | |
| 289 | |
| 290 | A workspace can have any number of owners, and always has at least one. |
| 291 | |
| 292 | ### Roles that add to a member |
| 293 | |
| 294 | An owner can give a member one or both of these roles. Each adds to what |
| 295 | the member already has; an owner has both already. |
| 296 | |
| 297 | | Role | Adds | |
| 298 | | --- | --- | |
| 299 | | **Billing manager** | Manages the workspace's billing as an owner does: the plan, budget and spend limit, AI credit and auto-reload, the card, billing details and invoices. Gives nothing on repositories. | |
| 300 | | **Security manager** | Read on every repository, and seeing and managing every security alert and security setting on them: dismissing and reopening alerts, custom patterns, reviewing push protection bypass requests, and the workspace's security settings. | |
| 301 | |
| 302 | Neither passes to an agent working for the person. |
| 303 | |
| 304 | ### Change someone's role |
| 305 | |
| 306 | On **People**, an owner opens the **⋯** menu beside a member: |
| 307 | |
| 308 | 1. **Make owner** or **Make member** changes their role. |
| 309 | 2. **Billing manager** and **Security manager** turn each role on or off. |
| 310 | 3. **Transfer ownership…** hands the workspace to that member: they become |
| 311 | an owner and you a member, in one step. To add an owner without stepping |
| 312 | down, choose **Make owner** instead. |
| 313 | 4. **Remove from {workspace}…** takes them out. Their roles on its |
| 314 | repositories and their place in its teams go too. |
| 315 | |
| 316 | Owners see a shield beside each member: green when two-factor |
| 317 | authentication is on, amber when it is off. |
| 318 | |
| 319 | The last owner cannot be made a member, removed, or leave: make someone |
| 320 | else an owner first, or [delete the workspace](#delete-a-workspace). |
| 321 | |
| 322 | ### Leave a workspace |
| 323 | |
| 324 | Anyone can leave a workspace they belong to: at the bottom of **People**, |
| 325 | choose **Leave {workspace}** and confirm. Your roles on its repositories |
| 326 | and your place in its teams go with you at once. The only owner cannot |
| 327 | leave. |
| 328 | |
| 329 | ### Add people |
| 330 | |
| 331 | Whoever creates a workspace is its owner. Nobody is added to a workspace |
| 332 | without saying yes: an owner invites people, and each person accepts or |
| 333 | declines. |
| 334 | |
| 335 | This is an invitation to join one workspace. It is not the same as an |
| 336 | invite to g1t, which only lets someone make an account: |
| 337 | |
| 338 | | | Invite to a workspace | Invite to g1t | |
| 339 | | --- | --- | --- | |
| 340 | | Where | The workspace's **People** page, **Invite to** *workspace* | [Settings → Invites](https://g1t.sh/settings/invites) | |
| 341 | | What they get | An invitation to join the workspace, to accept or decline | One new account, in no workspace but its own | |
| 342 | | Without an account | The invitation lets them sign up first, while g1t is invite-only | It lets them sign up | |
| 343 | | When | Always | Only while g1t is invite-only | |
| 344 | |
| 345 | To invite someone to g1t without adding them to your workspace, use |
| 346 | [Settings → Invites](/guides/authentication/#making-invites); the People |
| 347 | page links there while g1t is invite-only. |
| 348 | |
| 349 | On the workspace's **People**, `g1t.sh/<workspace>/-/people` (in the |
| 350 | sidebar): |
| 351 | |
| 352 | 1. Under **Invite to** *workspace name*, type a username, a name or an email address. |
| 353 | As you type, people on g1t are offered by username and name, with their |
| 354 | pictures; hover over one for their card. Only usernames, names and |
| 355 | pictures are shown, never anyone's email address. |
| 356 | 2. Choose the **Role** they join with: **Member** or **Owner**. |
| 357 | 3. Select **Invite**. |
| 358 | |
| 359 | - **By username**: they get a |
| 360 | [workspace invitation](/guides/authentication/#workspace-invitations) in |
| 361 | their notifications and by email, and join with that role when they accept at |
| 362 | [g1t.sh/invitations](https://g1t.sh/invitations). If they decline, you |
| 363 | are told in your notifications. It costs nothing. |
| 364 | - **By email address**: g1t emails an invite that only that address can |
| 365 | use. With a g1t account, it is a workspace invitation like the one above |
| 366 | and costs nothing. Without one, the invitation also lets them make the |
| 367 | account first; while g1t is invite-only that uses one of the workspace's |
| 368 | granted invites, or else one of yours (see |
| 369 | [invites](/guides/authentication/#invites)), and once anyone can sign up |
| 370 | it costs nothing. The new account is then invited to the workspace, and |
| 371 | joins when it accepts. The page never says which it was. |
| 372 | |
| 373 | The email names you and the workspace and links to the invite's page. |
| 374 | Someone new signs up right there, with the invited address filled in; once |
| 375 | the address is confirmed (straight away when they opened the page from |
| 376 | that email, which proves the address is theirs, otherwise with the code g1t |
| 377 | emails them), they are asked to accept or decline the invitation. Someone |
| 378 | with an account signs in and accepts on the page. Accepting lands them in |
| 379 | the workspace, with a one-time welcome. See |
| 380 | [using an invite](/guides/authentication/#using-an-invite). |
| 381 | |
| 382 | Pending invitations are listed under the members, with the person or |
| 383 | address, the role, until when it works (30 days), a link to copy and |
| 384 | **Revoke**: one waiting to be used, one whose new account is **confirming |
| 385 | their email**, and one **waiting for them to accept**. Converting an |
| 386 | outside collaborator to a member sends them an invitation the same way. |
| 387 | Through the API, use |
| 388 | [`POST /workspaces/{workspace}/invitations`](/reference/api/invites/invite-member/) |
| 389 | with a `username` or an `email` and a `role` (the `workspace` tool's |
| 390 | `invite_member` action over MCP); the person answers with |
| 391 | [`POST /user/invitations/{id}/accept`](/reference/api/invites/accept-invitation/) |
| 392 | or [`/decline`](/reference/api/invites/decline-invitation/). |
| 393 | |
| 394 | To give someone a role on one repository without making them a member, |
| 395 | add them as an [outside collaborator](/guides/access-and-roles/#outside-collaborators). |
| 396 | |
| 397 | **A free workspace cannot add people.** Until it starts the g1t plan, it |
| 398 | cannot add members, send invites, or invite outside collaborators, and an |
| 399 | invite sent before waits until the plan is on. Its members stay. People |
| 400 | shows **Start the plan to invite people** with the button in place of the |
| 401 | form, and the API and MCP answer `402` (`payment_required`). See |
| 402 | [who a free workspace can add](/guides/usage-and-billing/#who-a-free-workspace-can-add). |
| 403 | |
| 404 | ### Members through the API |
| 405 | |
| 406 | | Route | MCP tool and action | What it does | Who | |
| 407 | | --- | --- | --- | --- | |
| 408 | | `GET /workspaces/{workspace}/members` | `workspace` `list_members` | Its members, owners first: `role` (`owner` or `member`), `org_roles` (`billing_manager`, `security_manager`) and, for owners, `two_factor`. | Members | |
| 409 | | `PATCH /workspaces/{workspace}/members/{username}` | `workspace` `update_member` | Change `role` and `org_roles` (a list that replaces theirs). | Owners | |
| 410 | | `DELETE /workspaces/{workspace}/members/{username}` | `workspace` `remove_member` | Remove someone. Your own username is leaving. | Owners | |
| 411 | | `POST /workspaces/{workspace}/transfer_ownership` | `workspace` `transfer_ownership` | Hand it to `username`: they become an owner, you a member. | Owners | |
| 412 | | `DELETE /user/memberships/{workspace}` | `workspace` `leave` | Leave it. | You | |
| 413 | |
| 414 | Each is for people, signed in or with a personal access token; never an |
| 415 | agent. A change that would leave no owner answers `409`. |
| 416 | |
| 417 | ```sh |
| 418 | curl -X PATCH https://api.g1t.sh/workspaces/acme/members/grace \ |
| 419 | -H "Authorization: Bearer $G1T_TOKEN" \ |
| 420 | -d '{"org_roles": ["security_manager"]}' |
| 421 | ``` |
| 422 | |
| 423 | ## Member privileges |
| 424 | |
| 425 | What members can do beyond their role on each repository. Owners set them |
| 426 | in the workspace's **Settings → Member privileges**, |
| 427 | `g1t.sh/<workspace>/-/settings#member-privileges`, and can always do all of |
| 428 | it themselves. |
| 429 | |
| 430 | | Setting | Default | When on | |
| 431 | | --- | --- | --- | |
| 432 | | **Members can create public repositories** (`members_can_create_public_repositories`) | On | Any member can create a public repository. | |
| 433 | | **Members can create private repositories** (`members_can_create_private_repositories`) | On | Any member can create a private repository. | |
| 434 | | **Repository admins can change visibility** (`members_can_change_repo_visibility`) | On | A member with Admin on a repository can make it public or private, if they could create one of that kind. | |
| 435 | | **Repository admins can delete and transfer repositories** (`members_can_delete_repositories`) | Off | A member with Admin on a repository can delete it, or transfer it to a workspace where they can create one. | |
| 436 | | **Repository admins can add outside collaborators** (`members_can_invite_outside_collaborators`) | On | A member with Admin on a repository can give a role on it to someone outside the workspace. | |
| 437 | |
| 438 | When one is off, only owners can do it; the refusal says so. Someone who is |
| 439 | not a member, an outside collaborator with Admin, never gets these. |
| 440 | Forking private repositories is not a setting: g1t has no personal forks |
| 441 | to allow or refuse. |
| 442 | |
| 443 | Through the API, `GET /workspaces/{workspace}` returns each by its name, |
| 444 | and [`PATCH /workspaces/{workspace}`](/reference/api/workspaces/update-workspace/) |
| 445 | sets any of them (`workspace` `update` over MCP). Each change is in the |
| 446 | [audit log](/guides/audit-log/) as `workspace.member_privileges_changed`. |
| 447 | |
| 448 | ## Require two-factor authentication |
| 449 | |
| 450 | An owner can require everyone with access to the workspace, its members |
| 451 | and its outside collaborators, to have |
| 452 | [two-factor authentication](/guides/authentication/#two-factor-authentication) |
| 453 | on. |
| 454 | |
| 455 | 1. Turn it on for your own account first. |
| 456 | 2. Open **Settings**, `g1t.sh/<workspace>/-/settings#two-factor`. Under |
| 457 | **Authentication security**, it says how many members do not have it on, |
| 458 | and who. |
| 459 | 3. Turn on **Require two-factor authentication** and choose **Save**. |
| 460 | |
| 461 | From then on, someone without it keeps their place but cannot use the |
| 462 | workspace: its private repositories, pages and API answer as if they were |
| 463 | not a member, and every page shows them a notice with a link to turn it |
| 464 | on. Turning it on gives everything back at once. Nobody can join or accept |
| 465 | an invitation to the workspace without it. |
| 466 | |
| 467 | Through the API, `two_factor_requirement_enabled` on |
| 468 | `PATCH /workspaces/{workspace}`. Recorded as `workspace.two_factor_required` |
| 469 | and `workspace.two_factor_not_required`. |
| 470 | |
| 471 | ## The workspace's page |
| 472 | |
| 473 | A workspace's own page, `g1t.sh/<workspace>`, has its icon, name, address |
| 474 | and description at the top, then its overview: your |
| 475 | [pinned projects](#pinned-and-recent-projects), then the most active ones, |
| 476 | the pull requests in progress across them, and **All projects**. Members |
| 477 | also see a **Usage** card with this month's spend, and who belongs. |
| 478 | |
| 479 | The workspace's other pages each have a heading of their own and a row in |
| 480 | [the sidebar](#the-sidebar), lit while you are on them. The trail in the |
| 481 | top bar, such as *acme / Projects*, leads back to the workspace's page. |
| 482 | |
| 483 | | Page | Address | Who | | |
| 484 | | --- | --- | --- | --- | |
| 485 | | **Overview** | `g1t.sh/<workspace>` | Everyone | The page above. | |
| 486 | | **Projects** | `/-/projects` | Everyone | Every project you can see. See [the Projects page](#the-projects-page). | |
| 487 | | [**Packages**](/guides/packages/) | `/-/packages` | Everyone | What the workspace publishes. A visitor opens it from **Packages** on the workspace's page. | |
| 488 | | [**Teams**](/guides/teams/) | `/-/teams` | Members | Groups of members given roles on repositories together, mentioned as `@workspace/team` and asked to review together. Each team has its own page at `/-/teams/<team>`. | |
| 489 | | **People** | `/-/people` | Members | Who belongs. Owners add and remove people here. | |
| 490 | | **Insights** | `/-/insights` | Members | Coming soon: how the whole workspace delivers. | |
| 491 | | **Settings** | `/-/settings` | Owners | How the workspace is set up and connected (below). | |
| 492 | |
| 493 | Each person sees the projects they can read: a member whose base permission |
| 494 | is None, an [outside collaborator](/guides/access-and-roles/#outside-collaborators) |
| 495 | or a visitor sees the public ones and those shared with them, without the |
| 496 | workspace's people, deployments or settings. |
| 497 | |
| 498 | Older addresses still work: `/-/members` opens People, and |
| 499 | `g1t.sh/<workspace>?tab=projects` (or `repositories`, `packages`, |
| 500 | `teams`, `people`, `insights` or `settings`) opens that page. |
| 501 | |
| 502 | ### The Projects page |
| 503 | |
| 504 | The Projects page, `g1t.sh/<workspace>/-/projects`, is made for workspaces with hundreds of projects: |
| 505 | |
| 506 | - **Find a project** matches every word you type in a project's name, its |
| 507 | address or its description. Press <kbd>/</kbd> anywhere on the page to |
| 508 | start typing. |
| 509 | - **Filters**: public or private; [what it is](/guides/projects/#what-a-project-is) |
| 510 | (apps, libraries, and tools, docs or other when the workspace has any); the language its |
| 511 | manifests say it is written in; only projects with |
| 512 | [Deployments](/guides/deployments/) on; and archived projects, which are |
| 513 | left out unless you ask for them. Each choice shows how many projects it |
| 514 | holds. |
| 515 | - **Sort** by recently updated (its settings or its last push, whichever is |
| 516 | later), recently pushed, most active, or name. Most active counts each |
| 517 | push, issue or pull request opened or closed, review, comment and |
| 518 | deployment, and what happened a week ago counts half as much. |
| 519 | - **List** or **grid**, 30 projects to a page. |
| 520 | - The arrow keys (or <kbd>j</kbd> and <kbd>k</kbd>) move between projects, |
| 521 | and <kbd>Enter</kbd> opens one. |
| 522 | |
| 523 | Everything you choose is in the address, so a filtered list can be |
| 524 | bookmarked or shared. |
| 525 | |
| 526 | ## The dock, the sidebar and the page |
| 527 | |
| 528 | Signed in, g1t is always about one workspace: the one you are in. On a |
| 529 | workspace's pages, and on a project in one of your workspaces, that is the |
| 530 | workspace the page belongs to; anywhere else, even on public pages such as |
| 531 | [Explore](https://g1t.sh/explore), someone's profile or another |
| 532 | workspace's public project, it stays the one you chose last. |
| 533 | |
| 534 | Each page has three parts: |
| 535 | |
| 536 | | Part | Where | What it holds | |
| 537 | | --- | --- | --- | |
| 538 | | **The dock** | A rounded bar down the left | g1t's mark, which goes to [Today](/guides/today/); the built-in apps; the apps you pinned; **Apps**; and at its foot **People**, **Workspace** and your account. | |
| 539 | | **The sidebar** | Beside the dock | The workspace and its switcher at the top, then the lists of the app you are in. Today and Apps have none. | |
| 540 | | **The page** | A rounded panel, the rest of the window | Its header: the button that shows or hides the sidebar, where you are, **Search or jump to** (<kbd>Ctrl</kbd> <kbd>K</kbd>, or <kbd>⌘</kbd> <kbd>K</kbd> on a Mac), [your spend this month](/guides/spend/#in-the-top-bar), **Ask g1t**, the [notifications](/guides/notifications/) bell and **Create new**. Then the page itself. | |
| 541 | |
| 542 | ### The dock |
| 543 | |
| 544 | The built-in apps are always in the dock, each with its name and what is |
| 545 | unread: |
| 546 | |
| 547 | | App | Opens | |
| 548 | | --- | --- | |
| 549 | | **Today** | What needs you across the workspace. See [Today](/guides/today/). | |
| 550 | | **Chat** | Channels and messages. See [Chat](/guides/chat/). | |
| 551 | | **Notifications** | Reviews, mentions, failures and what agents wait on. See [notifications](/guides/notifications/). | |
| 552 | | **Agents** | The workspace's agents and their sessions. See [agents](/guides/agents/). | |
| 553 | | **Code** | Projects, pull requests and checks. Not shown to a member without [Code access](/guides/agent-access/). | |
| 554 | | **Artifacts** | Documents, decks and pages. See [artifacts](/guides/artifacts/). | |
| 555 | | **People** | Everyone in the workspace, and its [teams](/guides/teams/). | |
| 556 | | **Workspace** | Usage, billing, integrations, policies and settings. | |
| 557 | |
| 558 | A bar on the dock's edge marks the app you are in. Your account is the |
| 559 | avatar at the foot: your status, your profile and settings, |
| 560 | [appearance](#appearance), the documentation, support, status, the |
| 561 | keyboard's shortcuts, and signing out. |
| 562 | |
| 563 | ### Appearance |
| 564 | |
| 565 | g1t comes in a dark theme and a light one. Until you choose, it follows |
| 566 | your system's setting. |
| 567 | |
| 568 | | Choice | What you see | |
| 569 | | --- | --- | |
| 570 | | **Auto** | Follows your system's light or dark setting, and changes when it does. | |
| 571 | | **Light** | A near-white page with white panels and a deeper lavender accent. | |
| 572 | | **Dark** | g1t's very dark gray with the lavender accent. | |
| 573 | |
| 574 | To change it: |
| 575 | |
| 576 | 1. Select your avatar at the foot of the dock. On a phone, open **More**, |
| 577 | then **You and help**. |
| 578 | 2. Under **Appearance**, select **Auto** (the screen icon), **Light** (the |
| 579 | sun) or **Dark** (the moon). |
| 580 | |
| 581 | The page changes at once. You can also choose under |
| 582 | [Settings → Account](https://g1t.sh/settings/account), or press |
| 583 | <kbd>Ctrl</kbd> <kbd>K</kbd> (<kbd>⌘</kbd> <kbd>K</kbd> on a Mac) and run |
| 584 | **Use light theme**, **Use dark theme** or **Use auto theme**. Signed out, |
| 585 | the same commands are in ⌘K, and the phone's menu has the switch. |
| 586 | |
| 587 | Your choice is kept in this browser, in a `g1t_theme` cookie, so every page |
| 588 | is drawn in it from the start; another browser or device starts on Auto. |
| 589 | Product screenshots on g1t.sh's home page, and the g1t mark on agents' |
| 590 | avatars, stay dark in either theme. |
| 591 | |
| 592 | These docs and [status.g1t.sh](https://status.g1t.sh/) also follow your |
| 593 | system's setting, each with its own switch for this browser: here, the |
| 594 | **Auto**, **Light** and **Dark** menu at the end of the header (at the foot |
| 595 | of the menu on a phone); on the status page, the three icons at the top. |
| 596 | |
| 597 | ### Apps |
| 598 | |
| 599 | Apps are what the workspace added from the [Marketplace](/guides/marketplace/) |
| 600 | that you can use: today, the integrations it connected, such as Sentry or |
| 601 | GitHub, each opening its own page; installed extensions join them once |
| 602 | extensions are published. An app you can't use shows **Request access**. |
| 603 | The built-in apps' own pages are in their sidebars, not in Apps: Code's has |
| 604 | **Projects**, **Security** and **Packages**; Agents' has **Templates**, |
| 605 | **Context** and **Memory**; People's has **Teams**; Workspace's has **Usage**, |
| 606 | **AI Gateway**, **Integrations** and the **Audit log**. |
| 607 | |
| 608 | A pinned app shows as its mark under the built-in ones, in the order you |
| 609 | pinned them. To pin one: |
| 610 | |
| 611 | 1. Select **Apps** near the foot of the dock, or open the Apps page at |
| 612 | `g1t.sh/<workspace>/-/apps`. |
| 613 | 2. Find the app, by name if you like. |
| 614 | 3. Select the pin on its tile. Select it again to unpin it. |
| 615 | |
| 616 | When the workspace hasn't added anything yet, the launcher and the Apps |
| 617 | page say so and lead to the Marketplace. The launcher's **Marketplace** |
| 618 | link always does. |
| 619 | |
| 620 | Your pins are yours alone and each workspace has its own. They are saved |
| 621 | to your account, so your dock is the same on every browser and device you |
| 622 | sign in on, in the order you pinned. |
| 623 | |
| 624 | ### The sidebar |
| 625 | |
| 626 | The sidebar's top row names the workspace you are in. Select it to switch |
| 627 | to another of your workspaces, make a new one, or open your profile or |
| 628 | settings. The button beside it hides the sidebar, and the same button at |
| 629 | the left of the page's header brings it back; <kbd>Ctrl</kbd> <kbd>B</kbd> |
| 630 | (<kbd>⌘</kbd> <kbd>B</kbd> on a Mac) does both, except while you type. g1t |
| 631 | remembers which you chose. When the sidebar is hidden, or the app has none, |
| 632 | the page's header starts with the same switcher. |
| 633 | |
| 634 | Below it are the lists of the app you are in. Code's lists the workspace's |
| 635 | [projects](#pinned-and-recent-projects), and drills into a project's own |
| 636 | list when you open one, with **‹ All projects** at the top to go back. Its |
| 637 | **Settings** opens one level further: **General**, **Deployments**, |
| 638 | **Domains**, **Agents**, **Guardrails**, **Repository**, **Access**, |
| 639 | **Branches and merging**, **Secrets and variables** and **Webhooks**, each |
| 640 | for the roles that can use it. A link straight to any of these pages opens |
| 641 | the sidebar already there. |
| 642 | |
| 643 | Workspace's sidebar lists the workspace's **Overview**; under **Money**, |
| 644 | [**Spend**](/guides/spend/), **Usage**, **AI Gateway**, |
| 645 | **Billing and plans**; for owners, **Runners** under **Compute**; |
| 646 | **Integrations**, its security policies, the |
| 647 | **Audit log** and **Settings**, which slides over to how the workspace is |
| 648 | set up: |
| 649 | |
| 650 | | Settings | Who | | |
| 651 | | --- | --- | --- | |
| 652 | | **General** | Owners | The icon, the display name, a one-line description, the address (the slug), [who can create teams](/guides/teams/#who-can-create-teams), and [data residency](#data-residency). | |
| 653 | | **Chat** | Members | What members may do in chat. Owners change it. | |
| 654 | | **Repositories** | Members | The workspace's repositories. Owners also see **Recently deleted**, where a [deleted repository](/guides/managing-repositories/#restore-a-repository) can be restored, or purged, for 30 days. | |
| 655 | | **Access tokens** | Members | The workspace's own tokens. Owners create and delete them. | |
| 656 | | **Personal access tokens** | Owners | The workspace's rules for members' tokens, and approving them. | |
| 657 | | [**Webhooks**](/guides/webhooks/) | Members | Where the workspace's events are sent. Owners add and change them. | |
| 658 | | **Emoji** | Members | The workspace's own emoji. | |
| 659 | | [**Secrets and variables**](/guides/secrets-and-variables/) | Members | What runs and deployments are given. Owners change them. | |
| 660 | | **Actions** | Members | How workflows run in the workspace. | |
| 661 | | **Runners** | Owners | The workspace's self-hosted machines, their groups and registration tokens. | |
| 662 | |
| 663 | **People** is for every member to see; owners add and remove people there, |
| 664 | set the [base permission](/guides/access-and-roles/#the-base-permission), |
| 665 | and see the **Outside collaborators** tab. Each member's row also shows the |
| 666 | [teams](/guides/teams/) they are in that you can see. |
| 667 | |
| 668 | Below 1024px wide, the sidebar opens over the page from the left, from the |
| 669 | header's button, and closes when you open a page. |
| 670 | |
| 671 | ### Pinned and recent projects |
| 672 | |
| 673 | However many projects a workspace has, Code's sidebar lists a few: |
| 674 | |
| 675 | - **Pinned**: the projects you pinned, in your order, up to eight a |
| 676 | workspace. Pin one with **Pin** on its page, or the pin on its row of the |
| 677 | Projects page or its card on the Overview. Drag a pinned project to move |
| 678 | it, or hold <kbd>Alt</kbd> and press the up or down arrow. |
| 679 | - **Recent**: the projects you opened last that you have not pinned, up to |
| 680 | five. |
| 681 | - **All projects**, with how many there are, opens the Projects page. |
| 682 | |
| 683 | Pins and recent projects are yours: nobody else sees them, and each |
| 684 | workspace has its own. ⌘K finds any project in the workspace, pinned or not. |
| 685 | From the API, use |
| 686 | [`GET /user/pinned_projects/{workspace}`](/reference/api/pinned-projects/list-pinned-projects/) |
| 687 | and the other [pinned projects](/reference/api/pinned-projects/list-pinned-projects/) |
| 688 | operations, or the `workspace` tool's `list_pinned_projects`, |
| 689 | `pin_project`, `unpin_project` and `reorder_pinned_projects` actions |
| 690 | over MCP. |
| 691 | |
| 692 | ### On your phone |
| 693 | |
| 694 | On a screen narrower than a tablet, g1t keeps the same places and moves |
| 695 | them within reach of your thumb: |
| 696 | |
| 697 | | | What it does | |
| 698 | | --- | --- | |
| 699 | | **The bar along the bottom** | **Today**, **Chat**, **Notifications**, **Agents** and **Code** (for members with Code access), each with what is unread, and **More**. It steps aside while the keyboard is up and inside a conversation. | |
| 700 | | **More** | A panel above the bar with **All apps**, the [Marketplace](/guides/marketplace/), your pinned apps, **Artifacts**, **People**, **Workspace**, and **You and help**: your status, profile and settings, [appearance](#appearance), the documentation, support, status, the keyboard's shortcuts and signing out. | |
| 701 | | **The sidebar button**, at the left of the page's header | Opens the sidebar of the app you are in from the left: the same lists and links as on a computer. Tap outside it, or open a page, and it closes. | |
| 702 | | **The tab you are already on** | Tap it again to open that app's sidebar too. | |
| 703 | | **The workspace's name** in the page's header | Switches workspace, or opens your profile or settings. | |
| 704 | |
| 705 | Inside a [project](/guides/projects/), its pages (**Overview**, **Code**, |
| 706 | **Issues**, **Pull requests**, **Agents**, **Workflows**, **Deployments**, |
| 707 | **Insights** and, for the roles that see them, **Security** and |
| 708 | **Settings**) run in a row under its name that scrolls sideways, with the |
| 709 | page you are on kept in view, so issues and pull requests are one tap |
| 710 | away. Pages with more than one view, such as **Files**, **Commits** and |
| 711 | **Branches**, show those as a second row of tabs. |
| 712 | |
| 713 | Menus stay inside the screen, dialogs rise from the bottom and sit on top |
| 714 | of the keyboard while you type, and nothing scrolls the page sideways: a |
| 715 | wide file, diff or table scrolls within its own box. |
| 716 | |
| 717 | ### Signed out, and signing in |
| 718 | |
| 719 | Signing in, signing up, an invite link, the two-factor step, choosing a new |
| 720 | password and making your first workspace each stand on their own: the g1t |
| 721 | logo, the form, and links to the terms, privacy policy, docs, status and |
| 722 | support at the foot. Someone who is not signed in reads public pages, such |
| 723 | as Explore, a profile or a public project, under a plain header with |
| 724 | **Explore**, **Docs**, **Sign in** and **Sign up**; a project's pages run in |
| 725 | the row under its name. |
| 726 | |
| 727 | ## Mission control |
| 728 | |
| 729 | Mission control is Code's **Overview**, at `g1t.sh/<workspace>/-/overview`. |
| 730 | It shows where you are needed in the workspace's code, what its agents are |
| 731 | doing, and what landed without you. Signed in, `g1t.sh` itself opens |
| 732 | [Today](/guides/today/) in the workspace you are in. |
| 733 | |
| 734 | Under the greeting, one line sums up the week, such as *Agents landed 37 |
| 735 | of their 39 changes this week without you, and people landed 8 changes of |
| 736 | their own*. An agent's change landed without you when g1t merged it, by |
| 737 | auto-merge or from the [merge queue](/guides/merge-queue/), with no person |
| 738 | pressing merge. People's changes are their merged pull requests and the |
| 739 | commits they pushed straight to the default branch. A push is a person's |
| 740 | by the account that signed in to make it, not by the name on its commits: |
| 741 | pushes by g1t or a workflow job's token, and commits g1t wrote, are not |
| 742 | counted as people's. **Review N that need you** jumps to the |
| 743 | list, and **New issue** opens a new issue in the project you pick. |
| 744 | |
| 745 | | Across the top | What it counts | |
| 746 | | --- | --- | |
| 747 | | **Projects** | The workspace's projects, and how many were added this month. | |
| 748 | | **Agents** | Agent runs going now, and the hours agents worked in the last 7 days. | |
| 749 | | **Changes this week** | Pull requests merged in the last 7 days, and commits people pushed straight to the default branch, with the change from the 7 days before. The change is left out when g1t cannot read far enough back to count it. | |
| 750 | | **Landed without you** | The share of agents' changes that g1t merged with no person pressing merge. People's own changes are not counted in it. | |
| 751 | | **Need you** | What is waiting on you, and how many of those block work. | |
| 752 | |
| 753 | The list has three tabs. Each row opens to say more; the first is open. |
| 754 | |
| 755 | | Tab | What it lists | |
| 756 | | --- | --- | |
| 757 | | **Needs you** | Pull requests g1t stopped seeing through, reviews asked of you, changes ready for you to merge, failed checks, quiet agents, failed production builds, repository invitations and a usage limit that is close or reached. | |
| 758 | | **Waiting on agents** | Pull requests in an agent's hands (making the change, checking, reviewing, revising, catching up or in the merge queue), and runs going now. | |
| 759 | | **Landed today** | Pull requests merged today in your time zone, and whether a person merged them. | |
| 760 | |
| 761 | Each row in **Needs you** carries the reason it needs you: |
| 762 | |
| 763 | | Reason | Means | |
| 764 | | --- | --- | |
| 765 | | `BLOCKING` | Nothing moves until a person acts: a failed production build, a merge g1t could not make, or the usage limit. | |
| 766 | | `ASKED FOR YOU` | A review or an invitation addressed to you by name. | |
| 767 | | `CHECKS FAILING` | A required check still fails after the agent revised. | |
| 768 | | `OUTSIDE GUARDRAILS` | A run reached a cost or time cap set in [Guardrails](/guides/guardrails/). | |
| 769 | | `NEEDS REVIEW` | The repository wants a person's approval, or the review still asks for changes after the agent revised. | |
| 770 | | `STALLED` | An agent stopped, or has reported nothing for 10 minutes. | |
| 771 | | `READY TO MERGE` | Checks passed and it was approved; the repository lands changes only when a person merges them. | |
| 772 | |
| 773 | Opened, a row shows **The ask** (what g1t stopped with, and who the work |
| 774 | was started for), **What the agent already knows** (its checks, the files |
| 775 | and lines it changes, the test files it touches, how often the agent was |
| 776 | sent back, and what its runs cost) and **Why this needs you**. From |
| 777 | there, **Review and respond** opens it, and where it can be done without |
| 778 | leaving the page you can approve the change, merge it or re-run its failed |
| 779 | jobs. **By impact** puts the most urgent first; **Newest** sorts by time. |
| 780 | |
| 781 | On the right, **This week** charts the changes landed each day, split |
| 782 | by who did the work: agents on their own, agents with a person merging, |
| 783 | and people (their pull requests and direct pushes, merges left out), with what |
| 784 | agents and sandboxes cost over the same days. **Activity** lists what |
| 785 | moved across the workspace, agents marked apart from people. The page |
| 786 | refreshes itself while agents are at work. |
| 787 | |
| 788 | ## Workspace access tokens |
| 789 | |
| 790 | A workspace has access tokens of its own, for CI, integrations and agents |
| 791 | that work for a team. There is no shared service account to create, pay |
| 792 | for or lose the password to. |
| 793 | |
| 794 | | | Personal token | Workspace token | |
| 795 | | --- | --- | --- | |
| 796 | | Belongs to | You | The workspace | |
| 797 | | Acts as | You | The workspace: its name is the author of what it does | |
| 798 | | Can reach | All your workspaces, one of them, or none ([where a token reaches](/guides/authentication/#where-a-token-reaches)) | That workspace only: all of its repositories, or the ones chosen | |
| 799 | | Can do | What its [permissions](/guides/authentication/#permissions) allow, never more than you can | What its permissions allow, with Write on the workspace's repositories (Admin with Repositories: admin); it cannot manage people, tokens or workspaces, and holds no account permissions | |
| 800 | | Expires | 7 days to 1 year, or never where the workspaces it reaches allow | 7 days to 1 year, or never | |
| 801 | | When its creator leaves | Stops working | Keeps working | |
| 802 | | Created by | You, in [Settings → Access tokens](https://g1t.sh/settings/tokens) | An owner, under the workspace's **Settings → Access tokens** | |
| 803 | |
| 804 | They are the same kind of token and are sent the same way; see |
| 805 | [access tokens](/guides/authentication/#access-tokens). With git, any |
| 806 | username works; the token is the password. `GET /user` answers with |
| 807 | `"kind": "workspace"` for one, and `"kind": "user"` for a personal token. |
| 808 | |
| 809 | Every member can see a workspace's tokens: the name, who created each, |
| 810 | its permissions and repositories, when it was last used and when it |
| 811 | expires. Only owners can create, change or delete them. An owner selects |
| 812 | **New token** and fills in the same form as a personal token: a name, an |
| 813 | expiration (No expiration shows a warning), its repositories (all, or the |
| 814 | ones chosen) and its permissions, starting on the CI preset. Each token |
| 815 | shows **Write** or **Admin**: give it **Repositories: admin** to let it |
| 816 | manage webhooks, secrets, deploy keys and who has access, and teams as an |
| 817 | owner would. Select a token to change its permissions or repositories, or |
| 818 | to delete it. |
| 819 | |
| 820 | Which of your members' own personal tokens reach the workspace is set under |
| 821 | **Settings → Personal access tokens**; see |
| 822 | [a workspace's rules for tokens](/guides/authentication/#a-workspaces-rules-for-tokens). |
| 823 | |
| 824 | ## Profiles |
| 825 | |
| 826 | Every person has a profile at `g1t.sh/u/<username>`, apart from the |
| 827 | workspaces at `g1t.sh/<workspace>`. Author names on issues and pull |
| 828 | requests link to it. |
| 829 | |
| 830 | **What it shows.** Your picture, name, username, pronouns, bio, location, |
| 831 | website and when you joined; then your work in three tabs: |
| 832 | |
| 833 | - **Overview:** your contribution calendar, then pull requests merged, |
| 834 | open pull requests and issues opened, and your most recent activity. |
| 835 | - **Pull requests** and **Issues:** everything you opened, and what g1t |
| 836 | opened for you, newest first, |
| 837 | with filters beside the list for state (open, closed, merged), type, |
| 838 | repository and sort order. Add `?tab=pulls&state=merged` and the like to |
| 839 | link to a filtered list. |
| 840 | |
| 841 | **The contribution calendar.** The last year as a square a day, a column a |
| 842 | week, shaded more strongly the more you did that day, with the total |
| 843 | above it ("128 contributions in the last year"). A contribution is a |
| 844 | commit you pushed, an issue or pull request you opened (or g1t opened for |
| 845 | you), and a review you gave. Days are counted in UTC. Hover over a square, |
| 846 | or tap it, to see its day, its count and how many were commits ("5 |
| 847 | contributions on Oct 4, 2026, 3 of them commits"). On a narrow screen the |
| 848 | calendar scrolls sideways inside its card, starting at today. |
| 849 | |
| 850 | Commits count like this: |
| 851 | |
| 852 | - **Pushed to the default branch, or to `gh-pages`.** Commits on other |
| 853 | branches count once they reach the default branch, which is usually a |
| 854 | pull request, and the pull request is counted already. |
| 855 | - **Credited to whoever pushed,** on the day of the push, not to the |
| 856 | commits' authors. Pushes with an agent's, a workspace's or a workflow |
| 857 | job's token are not counted on anyone's calendar. |
| 858 | - **The new commits along the branch's own line,** at most 50 a push. A |
| 859 | merge commit counts once. The first push of a branch counts one, so |
| 860 | importing a long history doesn't fill a single day. |
| 861 | - **Only from the time this was added:** pushes before 9 October 2026 are |
| 862 | not counted. |
| 863 | |
| 864 | **Edit it** in [Settings → Profile](https://g1t.sh/settings/profile). Every |
| 865 | field is optional. The bio takes up to 160 characters and is also what a |
| 866 | link to your profile says. The website must be an `https://` address; |
| 867 | `example.com` is saved as `https://example.com`. Your email address is |
| 868 | never shown. |
| 869 | |
| 870 | **Time zone.** Pick the time zone you are in, by city or region (such as |
| 871 | `America/Denver`), and the [card over your name](#the-card-over-a-name) |
| 872 | shows your local time, so people can tell whether it is a good moment to |
| 873 | ask you something. If your browser's time zone differs from the one |
| 874 | saved, the field offers **Use my browser's time zone**. Choose **Not |
| 875 | shown** to clear it. |
| 876 | |
| 877 | **Who sees what.** A profile is public, but the work and workspaces on it |
| 878 | are filtered for whoever is looking: |
| 879 | |
| 880 | | On the profile | Shown to a visitor when | |
| 881 | | --- | --- | |
| 882 | | An issue or pull request, and its title | They can read its repository: it is public, or they are a member of its workspace | |
| 883 | | The counts, and the contribution calendar | Only what they could see is counted | |
| 884 | | A workspace | They are a member of it too, or you made a public project in it, whose page shows that already | |
| 885 | |
| 886 | Someone signed out sees your public work and the workspaces where you made |
| 887 | a public project; nothing else, and their calendar counts only work in |
| 888 | public repositories. The link preview for a profile uses only public work. |
| 889 | |
| 890 | **How it is laid out.** Signed out, a profile, Explore and Search are |
| 891 | shown with g1t's public header (search, Explore, Docs, signing in) and the page |
| 892 | at full width, with no workspace sidebar. Signed in, the dock stays, but |
| 893 | no mode is lit and no mode's sidebar opens beside these pages: they are |
| 894 | nobody's workspace, and the profile's own left column says whose it is. |
| 895 | |
| 896 | ### The card over a name |
| 897 | |
| 898 | Hold the pointer over a person's name or picture anywhere on g1t, or move |
| 899 | the keyboard focus to their name, and a card opens with their profile at a |
| 900 | glance: |
| 901 | |
| 902 | | On the card | Shown when | |
| 903 | | --- | --- | |
| 904 | | Picture, name, username and pronouns | Always | |
| 905 | | Bio and location | They filled them in | |
| 906 | | Their local time, such as **3:42 PM local time** | They set a [time zone](#profiles) | |
| 907 | | **Member of** | The same workspaces their profile shows you, at most three named | |
| 908 | | **Committed to this repository in the past day**, **week** or **month** | You opened it inside a repository you can read, and their latest commit on its default branch is that recent | |
| 909 | |
| 910 | On a touch screen no card opens: a tap goes to the profile. `@g1t` has a |
| 911 | card of its own, about putting g1t to work. `ghost`, which stands in for |
| 912 | deleted accounts, has no card. |
| 913 | |
| 914 | ### Commits and your account |
| 915 | |
| 916 | A commit shows as yours, with your username, picture, profile link and |
| 917 | card, when its author address is one of your |
| 918 | [confirmed addresses](/guides/authentication/#email-addresses) or your |
| 919 | noreply address. This holds everywhere a commit appears: the Files page, |
| 920 | history, a commit, blame, branches, tags, comparisons and the |
| 921 | Contributors list, which counts every address of yours as one person. |
| 922 | |
| 923 | To have commits made on your own machine show as yours without publishing |
| 924 | your address, commit with your noreply address: |
| 925 | |
| 926 | 1. Open [Settings → Emails](https://g1t.sh/settings/emails) and copy your |
| 927 | noreply address. It looks like |
| 928 | `<8 characters of your account id>+<username>@users.noreply.g1t.sh`. |
| 929 | 2. Set it for every repository, or leave out `--global` for one: |
| 930 | |
| 931 | ```sh |
| 932 | git config --global user.email "6c1d0efg+sam@users.noreply.g1t.sh" |
| 933 | ``` |
| 934 | |
| 935 | 3. Commit and push as usual. Commits you made before keep the address they |
| 936 | were made with; add that address to your account and confirm it to have |
| 937 | them show as yours. |
| 938 | |
| 939 | | A commit's address | Shown as | |
| 940 | | --- | --- | |
| 941 | | One of your confirmed addresses, or your noreply address | You | |
| 942 | | An address added to an account but not confirmed | The name in the commit | |
| 943 | | An address no account has | The name in the commit, with a plain picture, no link and no card | |
| 944 | | A deleted account's noreply address, or any of its confirmed addresses during the 30 days it can be restored | `ghost` | |
| 945 | | g1t's own (`g1t@users.noreply.g1t.sh`) | `g1t` | |
| 946 | |
| 947 | `Co-authored-by` trailers are matched the same way, and their pictures sit |
| 948 | beside the author's. An address itself is never shown on g1t. |