Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.
| docs.g1t.sh, generated OpenAPI with an interactive reference, full footer | 1 | # Accounts and authentication |
| 2 | ||
| 3 | ## Creating an account | |
| 4 | ||
| 5 | Register at [g1t.sh/register](https://g1t.sh/register), or through the API: | |
| 6 | ||
| 7 | ```sh | |
| 8 | curl -X POST https://api.g1t.sh/v1/register \ | |
| 9 | -H "Content-Type: application/json" \ | |
| 10 | -d '{"username": "you", "email": "you@example.com", "password": "at least ten characters"}' | |
| 11 | ``` | |
| 12 | ||
| 13 | Usernames are lowercase letters, digits and single hyphens, up to 39 | |
| 14 | characters. Your username is your namespace: `g1t.sh/<username>`. | |
| 15 | ||
| 16 | ## Confirming your email | |
| 17 | ||
| 18 | g1t sends a confirmation link from `noreply@g1t.sh`. It works for 24 hours. | |
| 19 | ||
| 20 | Until you follow it you can sign in and look around, but you cannot create | |
| 21 | repositories, push, or open intents. Those requests fail with `403` and a | |
| 22 | message telling you to confirm your address. To get a new link, sign in and | |
| 23 | use the banner at the top of the site. | |
| 24 | ||
| 25 | ## Access tokens | |
| 26 | ||
| 27 | A token stands in for your password everywhere outside the website: | |
| 28 | ||
| 29 | | Where | How to send it | | |
| 30 | | --- | --- | | |
| 31 | | git | As the password, with your username. | | |
| 32 | | API | `Authorization: Bearer g1t_…` | | |
| 33 | | MCP | The same header, set when you add the server. | | |
| 34 | ||
| 35 | Create one in [Settings](https://g1t.sh/settings), or with your password: | |
| 36 | ||
| 37 | ```sh | |
| 38 | curl -X POST https://api.g1t.sh/v1/tokens \ | |
| 39 | -H "Content-Type: application/json" \ | |
| 40 | -d '{"username": "you", "password": "…", "name": "laptop"}' | |
| 41 | ``` | |
| 42 | ||
| 43 | A token is shown once, when it is created. g1t stores only a hash of it. If | |
| 44 | you lose one, delete it and create another. Delete a token the moment you | |
| 45 | think someone else has seen it. | |
| 46 | ||
| 47 | A token has the full rights of your account. Scoped tokens are planned. | |
| 48 | ||
| 49 | ## Resetting your password | |
| 50 | ||
| 51 | Use [g1t.sh/forgot](https://g1t.sh/forgot). The emailed link works for one | |
| 52 | hour. Setting a new password signs you out everywhere. | |
| 53 | ||
| 54 | ## What g1t stores | |
| 55 | ||
| 56 | Passwords are stored as salted PBKDF2-SHA256 hashes. Sessions and tokens are | |
| 57 | stored as SHA-256 hashes. Neither can be read back. |