[{"data":1,"prerenderedAt":938},["ShallowReactive",2],{"navigation_docs":3,"-guide-tokens-and-auth":85,"-guide-tokens-and-auth-surround":933},[4,26,49,73],{"title":5,"path":6,"stem":7,"children":8,"page":25},"Getting Started","\u002Fgetting-started","docs",[9,13,17,21],{"title":10,"path":11,"stem":12},"Introduction","\u002Fgetting-started\u002Fintroduction","docs\u002F1.getting-started\u002F1.introduction",{"title":14,"path":15,"stem":16},"Installation","\u002Fgetting-started\u002Finstallation","docs\u002F1.getting-started\u002F2.installation",{"title":18,"path":19,"stem":20},"Quick Start","\u002Fgetting-started\u002Fquick-start","docs\u002F1.getting-started\u002F3.quick-start",{"title":22,"path":23,"stem":24},"Agent Skills","\u002Fgetting-started\u002Fagent-skills","docs\u002F1.getting-started\u002F4.agent-skills",false,{"title":27,"path":28,"stem":7,"children":29,"page":25},"Frameworks","\u002Fframeworks",[30,35,40,44],{"title":31,"path":32,"stem":33,"icon":34},"eve","\u002Fframeworks\u002Feve","docs\u002F2.frameworks\u002F1.eve","i-custom:eve",{"title":36,"path":37,"stem":38,"icon":39},"AI SDK","\u002Fframeworks\u002Fai-sdk","docs\u002F2.frameworks\u002F2.ai-sdk","i-simple-icons-vercel",{"title":41,"path":42,"stem":43,"icon":39},"Vercel Workflow","\u002Fframeworks\u002Fvercel-workflow","docs\u002F2.frameworks\u002F3.vercel-workflow",{"title":45,"path":46,"stem":47,"icon":48},"Chat SDK","\u002Fframeworks\u002Fchat-sdk","docs\u002F2.frameworks\u002F4.chat-sdk","i-lucide-message-square",{"title":50,"path":51,"stem":7,"children":52,"page":25},"Guide","\u002Fguide",[53,57,61,65,69],{"title":54,"path":55,"stem":56},"Scope with Presets","\u002Fguide\u002Fpresets","docs\u002F3.guide\u002F1.presets",{"title":58,"path":59,"stem":60},"Control Write Safety","\u002Fguide\u002Fapproval-control","docs\u002F3.guide\u002F2.approval-control",{"title":62,"path":63,"stem":64},"Commit Attribution","\u002Fguide\u002Fcommit-attribution","docs\u002F3.guide\u002F3.commit-attribution",{"title":66,"path":67,"stem":68},"Tokens & Auth","\u002Fguide\u002Ftokens-and-auth","docs\u002F3.guide\u002F4.tokens-and-auth",{"title":70,"path":71,"stem":72},"Examples","\u002Fguide\u002Fexamples","docs\u002F3.guide\u002F5.examples",{"title":74,"path":75,"stem":7,"children":76,"page":25},"Api","\u002Fapi",[77,81],{"title":78,"path":79,"stem":80},"Tools Catalog","\u002Fapi\u002Ftools-catalog","docs\u002F4.api\u002F1.tools-catalog",{"title":82,"path":83,"stem":84},"API Reference","\u002Fapi\u002Freference","docs\u002F4.api\u002F2.reference",{"id":86,"title":87,"body":88,"description":918,"extension":919,"links":920,"meta":929,"navigation":930,"path":67,"seo":931,"stem":68,"__hash__":932},"docs\u002Fdocs\u002F3.guide\u002F4.tokens-and-auth.md","Tokens and Authentication",{"type":89,"value":90,"toc":902},"minimark",[91,110,140,145,148,165,169,333,337,352,713,723,727,804,822,826,859,865,869,898],[92,93,94,95,99,100,109],"p",{},"Every tool call hits the GitHub API with the token you provide. Scoping that token correctly is the first line of defense. You have two main options: a ",[96,97,98],"strong",{},"fine-grained personal access token"," you manage yourself, or short-lived tokens minted by ",[96,101,102],{},[103,104,108],"a",{"href":105,"rel":106},"https:\u002F\u002Fvercel.com\u002Fdocs\u002Fconnect",[107],"nofollow","Vercel Connect",".",[111,112,116,119],"prompt",{":actions":113,"description":114,"icon":115},"[\"copy\",\"cursor\",\"windsurf\"]","Align GitHub PAT with tool presets","i-lucide-key-round",[92,117,118],{},"Review GitHub token permissions for this @github-tools\u002Fsdk integration.",[120,121,122,126,133],"ul",{},[123,124,125],"li",{},"Match the PAT scopes to the preset in use (repo-explorer, code-review, issue-triage, ci-ops, maintainer)",[123,127,128,129],{},"Apply least privilege per repository; follow ",[103,130,131],{"href":131,"rel":132},"https:\u002F\u002Fgithub-tools.com\u002Fguide\u002Ftokens-and-auth",[107],[123,134,135,136],{},"Cross-check write safety with ",[103,137,138],{"href":138,"rel":139},"https:\u002F\u002Fgithub-tools.com\u002Fguide\u002Fapproval-control",[107],[141,142,144],"h2",{"id":143},"create-a-fine-grained-token","Create a fine-grained token",[92,146,147],{},"Fine-grained personal access tokens let you restrict access per repository and per permission category. This is the recommended type for any production assistant.",[149,150,151,159,162],"ol",{},[123,152,153,154],{},"Go to ",[103,155,158],{"href":156,"rel":157},"https:\u002F\u002Fgithub.com\u002Fsettings\u002Fpersonal-access-tokens\u002Fnew",[107],"github.com\u002Fsettings\u002Fpersonal-access-tokens\u002Fnew",[123,160,161],{},"Select only the repositories your agent needs",[123,163,164],{},"Enable permissions based on the preset you plan to use (see matrix below)",[141,166,168],{"id":167},"map-permissions-to-presets","Map permissions to presets",[170,171,172,200],"table",{},[173,174,175],"thead",{},[176,177,178,182,185,188,191,194,197],"tr",{},[179,180,181],"th",{},"Preset",[179,183,184],{},"Repository access",[179,186,187],{},"Contents",[179,189,190],{},"Pull requests",[179,192,193],{},"Issues",[179,195,196],{},"Actions",[179,198,199],{},"Administration",[201,202,203,229,257,280,303],"tbody",{},[176,204,205,212,215,220,223,225,227],{},[206,207,208],"td",{},[209,210,211],"code",{},"repo-explorer",[206,213,214],{},"selected repos",[206,216,217],{},[209,218,219],{},"read",[206,221,222],{},"—",[206,224,222],{},[206,226,222],{},[206,228,222],{},[176,230,231,236,238,242,251,253,255],{},[206,232,233],{},[209,234,235],{},"code-review",[206,237,214],{},[206,239,240],{},[209,241,219],{},[206,243,244,246,247,250],{},[209,245,219],{}," (or ",[209,248,249],{},"write"," for comments)",[206,252,222],{},[206,254,222],{},[206,256,222],{},[176,258,259,264,266,270,272,276,278],{},[206,260,261],{},[209,262,263],{},"issue-triage",[206,265,214],{},[206,267,268],{},[209,269,219],{},[206,271,222],{},[206,273,274],{},[209,275,249],{},[206,277,222],{},[206,279,222],{},[176,281,282,287,289,293,295,297,301],{},[206,283,284],{},[209,285,286],{},"ci-ops",[206,288,214],{},[206,290,291],{},[209,292,219],{},[206,294,222],{},[206,296,222],{},[206,298,299],{},[209,300,249],{},[206,302,222],{},[176,304,305,310,312,316,320,324,328],{},[206,306,307],{},[209,308,309],{},"maintainer",[206,311,214],{},[206,313,314],{},[209,315,249],{},[206,317,318],{},[209,319,249],{},[206,321,322],{},[209,323,249],{},[206,325,326],{},[209,327,249],{},[206,329,330,332],{},[209,331,249],{}," (for repo creation and forking)",[141,334,336],{"id":335},"mint-tokens-with-vercel-connect","Mint tokens with Vercel Connect",[92,338,339,340,343,344,347,348,351],{},"For agents deployed on Vercel, ",[103,341,108],{"href":105,"rel":342},[107]," replaces long-lived PATs entirely. You attach a ",[96,345,346],{},"GitHub connector"," (a Vercel-managed GitHub App) to your project, and your server code requests a ",[96,349,350],{},"short-lived, scoped token"," at runtime — no secret to store, rotate, or leak.",[353,354,356,361,376,380,391,395,410],"steps",{"level":355},"3",[357,358,360],"h3",{"id":359},"create-a-github-connector","Create a GitHub connector",[92,362,363,364,246,368,371,372,375],{},"Create a connector from the ",[103,365,367],{"href":105,"rel":366},[107],"Vercel dashboard",[209,369,370],{},"vercel connect"," in the CLI) with the type ",[209,373,374],{},"github",", then install it on the GitHub organization or user account your agent needs, selecting the repositories to expose.",[357,377,379],{"id":378},"link-it-to-your-project","Link it to your project",[92,381,382,383,386,387,390],{},"Link the connector to the Vercel project that runs your agent. On Vercel, the SDK authenticates automatically with the deployment's OIDC token. For local development, run ",[209,384,385],{},"vercel link"," then ",[209,388,389],{},"vercel env pull"," to get a development OIDC token.",[357,392,394],{"id":393},"request-a-token-at-runtime","Request a token at runtime",[92,396,397,398,401,402,405,406,409],{},"Install ",[209,399,400],{},"@vercel\u002Fconnect"," and call ",[209,403,404],{},"getToken"," with the permissions your preset needs, then pass the result as ",[209,407,408],{},"token",":",[411,412,418],"pre",{"className":413,"code":414,"filename":415,"language":416,"meta":417,"style":417},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { getToken } from '@vercel\u002Fconnect'\nimport { createGithubTools } from '@github-tools\u002Fsdk'\nimport { generateText } from 'ai'\n\nconst token = await getToken('github\u002Fmy-connector', {\n  subject: { type: 'app' },\n  scopes: ['contents:read', 'pull_requests:read'],\n})\n\nconst { text } = await generateText({\n  model: 'anthropic\u002Fclaude-sonnet-4.6',\n  tools: createGithubTools({ token, preset: 'code-review' }),\n  prompt: 'Summarize the open PRs on my-org\u002Fmy-repo.',\n})\n","connect-token.ts","ts","",[209,419,420,452,473,494,501,537,563,596,605,610,634,651,689,706],{"__ignoreMap":417},[421,422,425,429,433,437,440,443,446,449],"span",{"class":423,"line":424},"line",1,[421,426,428],{"class":427},"s7zQu","import",[421,430,432],{"class":431},"sMK4o"," {",[421,434,436],{"class":435},"sTEyZ"," getToken",[421,438,439],{"class":431}," }",[421,441,442],{"class":427}," from",[421,444,445],{"class":431}," '",[421,447,400],{"class":448},"sfazB",[421,450,451],{"class":431},"'\n",[421,453,455,457,459,462,464,466,468,471],{"class":423,"line":454},2,[421,456,428],{"class":427},[421,458,432],{"class":431},[421,460,461],{"class":435}," createGithubTools",[421,463,439],{"class":431},[421,465,442],{"class":427},[421,467,445],{"class":431},[421,469,470],{"class":448},"@github-tools\u002Fsdk",[421,472,451],{"class":431},[421,474,476,478,480,483,485,487,489,492],{"class":423,"line":475},3,[421,477,428],{"class":427},[421,479,432],{"class":431},[421,481,482],{"class":435}," generateText",[421,484,439],{"class":431},[421,486,442],{"class":427},[421,488,445],{"class":431},[421,490,491],{"class":448},"ai",[421,493,451],{"class":431},[421,495,497],{"class":423,"line":496},4,[421,498,500],{"emptyLinePlaceholder":499},true,"\n",[421,502,504,508,511,514,517,520,523,526,529,531,534],{"class":423,"line":503},5,[421,505,507],{"class":506},"spNyl","const",[421,509,510],{"class":435}," token ",[421,512,513],{"class":431},"=",[421,515,516],{"class":427}," await",[421,518,436],{"class":519},"s2Zo4",[421,521,522],{"class":435},"(",[421,524,525],{"class":431},"'",[421,527,528],{"class":448},"github\u002Fmy-connector",[421,530,525],{"class":431},[421,532,533],{"class":431},",",[421,535,536],{"class":431}," {\n",[421,538,540,544,546,548,551,553,555,558,560],{"class":423,"line":539},6,[421,541,543],{"class":542},"swJcz","  subject",[421,545,409],{"class":431},[421,547,432],{"class":431},[421,549,550],{"class":542}," type",[421,552,409],{"class":431},[421,554,445],{"class":431},[421,556,557],{"class":448},"app",[421,559,525],{"class":431},[421,561,562],{"class":431}," },\n",[421,564,566,569,571,574,576,579,581,583,585,588,590,593],{"class":423,"line":565},7,[421,567,568],{"class":542},"  scopes",[421,570,409],{"class":431},[421,572,573],{"class":435}," [",[421,575,525],{"class":431},[421,577,578],{"class":448},"contents:read",[421,580,525],{"class":431},[421,582,533],{"class":431},[421,584,445],{"class":431},[421,586,587],{"class":448},"pull_requests:read",[421,589,525],{"class":431},[421,591,592],{"class":435},"]",[421,594,595],{"class":431},",\n",[421,597,599,602],{"class":423,"line":598},8,[421,600,601],{"class":431},"}",[421,603,604],{"class":435},")\n",[421,606,608],{"class":423,"line":607},9,[421,609,500],{"emptyLinePlaceholder":499},[421,611,613,615,617,620,622,625,627,629,631],{"class":423,"line":612},10,[421,614,507],{"class":506},[421,616,432],{"class":431},[421,618,619],{"class":435}," text ",[421,621,601],{"class":431},[421,623,624],{"class":431}," =",[421,626,516],{"class":427},[421,628,482],{"class":519},[421,630,522],{"class":435},[421,632,633],{"class":431},"{\n",[421,635,637,640,642,644,647,649],{"class":423,"line":636},11,[421,638,639],{"class":542},"  model",[421,641,409],{"class":431},[421,643,445],{"class":431},[421,645,646],{"class":448},"anthropic\u002Fclaude-sonnet-4.6",[421,648,525],{"class":431},[421,650,595],{"class":431},[421,652,654,657,659,661,663,666,669,671,674,676,678,680,682,684,687],{"class":423,"line":653},12,[421,655,656],{"class":542},"  tools",[421,658,409],{"class":431},[421,660,461],{"class":519},[421,662,522],{"class":435},[421,664,665],{"class":431},"{",[421,667,668],{"class":435}," token",[421,670,533],{"class":431},[421,672,673],{"class":542}," preset",[421,675,409],{"class":431},[421,677,445],{"class":431},[421,679,235],{"class":448},[421,681,525],{"class":431},[421,683,439],{"class":431},[421,685,686],{"class":435},")",[421,688,595],{"class":431},[421,690,692,695,697,699,702,704],{"class":423,"line":691},13,[421,693,694],{"class":542},"  prompt",[421,696,409],{"class":431},[421,698,445],{"class":431},[421,700,701],{"class":448},"Summarize the open PRs on my-org\u002Fmy-repo.",[421,703,525],{"class":431},[421,705,595],{"class":431},[421,707,709,711],{"class":423,"line":708},14,[421,710,601],{"class":431},[421,712,604],{"class":435},[92,714,715,716,718,719,722],{},"Call ",[209,717,404],{}," per request rather than caching the string yourself — the SDK keeps an in-process cache and refreshes tokens as they approach expiry. For multi-tenant connectors (one connector installed on several GitHub organizations), pass ",[209,720,721],{},"installationId"," to target a specific installation.",[357,724,726],{"id":725},"why-connect-over-a-pat","Why Connect over a PAT",[170,728,729,740],{},[173,730,731],{},[176,732,733,735,738],{},[179,734],{},[179,736,737],{},"Fine-grained PAT",[179,739,108],{},[201,741,742,753,764,782,793],{},[176,743,744,747,750],{},[206,745,746],{},"Lifetime",[206,748,749],{},"Until expiry\u002Frevocation",[206,751,752],{},"Short-lived, auto-refreshed",[176,754,755,758,761],{},[206,756,757],{},"Storage",[206,759,760],{},"Env var \u002F secret manager",[206,762,763],{},"Nothing to store — minted at runtime",[176,765,766,769,772],{},[206,767,768],{},"Scoping",[206,770,771],{},"Set once at creation",[206,773,774,775,778,779],{},"Per-request ",[209,776,777],{},"scopes"," and ",[209,780,781],{},"repositories",[176,783,784,787,790],{},[206,785,786],{},"Multi-tenant",[206,788,789],{},"One token per org",[206,791,792],{},"One connector, many installations",[176,794,795,798,801],{},[206,796,797],{},"Rotation",[206,799,800],{},"Manual",[206,802,803],{},"Automatic",[805,806,807,810,811,814,815,818,819,821],"note",{},[96,808,809],{},"Roadmap"," — ",[103,812,813],{"href":32},"eve agents"," will resolve per-session GitHub tokens through eve connections (",[209,816,817],{},"auth: 'eve'",") backed by Vercel Connect, so each user of your agent authorizes their own GitHub access. For now, pass ",[209,820,408],{}," explicitly as shown above.",[141,823,825],{"id":824},"apply-least-privilege-step-by-step","Apply least-privilege step by step",[353,827,828,832,842,846,849,853],{"level":355},[357,829,831],{"id":830},"start-with-read-only","Start with read-only",[92,833,834,835,838,839,109],{},"Enable only ",[209,836,837],{},"contents: read"," and use ",[209,840,841],{},"preset: 'repo-explorer'",[357,843,845],{"id":844},"validate-in-staging","Validate in staging",[92,847,848],{},"Run the agent against a test repository and review all tool calls before adding write scopes.",[357,850,852],{"id":851},"add-writes-for-approved-operations","Add writes for approved operations",[92,854,855,856,109],{},"Enable write permissions only for the specific families you need, and combine with ",[103,857,858],{"href":59},"approval control",[805,860,861,862,109],{},"Safest baseline: fine-grained token (or Connect-minted token) + narrow preset + ",[209,863,864],{},"requireApproval: true",[141,866,868],{"id":867},"external-references","External references",[120,870,871,878,885,891],{},[123,872,873],{},[103,874,877],{"href":875,"rel":876},"https:\u002F\u002Fdocs.github.com\u002Fen\u002Frest\u002Fauthentication\u002Fpermissions-required-for-fine-grained-personal-access-tokens",[107],"Fine-grained PAT permissions",[123,879,880],{},[103,881,884],{"href":882,"rel":883},"https:\u002F\u002Fdocs.github.com\u002Fen\u002Fauthentication\u002Fkeeping-your-account-and-data-secure\u002Fmanaging-your-personal-access-tokens",[107],"Managing personal access tokens",[123,886,887],{},[103,888,890],{"href":105,"rel":889},[107],"Vercel Connect documentation",[123,892,893],{},[103,894,897],{"href":895,"rel":896},"https:\u002F\u002Fvercel.com\u002Fdocs\u002Fconnect\u002Fts-sdk-reference",[107],"Vercel Connect SDK reference",[899,900,901],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":417,"searchDepth":454,"depth":454,"links":903},[904,905,906,912,917],{"id":143,"depth":454,"text":144},{"id":167,"depth":454,"text":168},{"id":335,"depth":454,"text":336,"children":907},[908,909,910,911],{"id":359,"depth":475,"text":360},{"id":378,"depth":475,"text":379},{"id":393,"depth":475,"text":394},{"id":725,"depth":475,"text":726},{"id":824,"depth":454,"text":825,"children":913},[914,915,916],{"id":830,"depth":475,"text":831},{"id":844,"depth":475,"text":845},{"id":851,"depth":475,"text":852},{"id":867,"depth":454,"text":868},"Authenticate GitHub tools with fine-grained PATs or Vercel Connect — map token permissions to each preset and apply least privilege.","md",[921,926],{"label":922,"icon":923,"to":59,"color":924,"variant":925},"Control write safety","i-lucide-shield-check","neutral","subtle",{"label":927,"icon":928,"to":79,"color":924,"variant":925},"Browse all tools","i-lucide-list-tree",{},{"title":66},{"title":87,"description":918},"xCu5UrHKcvZWX6z6Rd_8-SLkf9C7nQwaQWscXR2am2w",[934,936],{"title":62,"path":63,"stem":64,"description":935,"children":-1},"Configure author, committer, and co-authorship for commits created by GitHub tools.",{"title":70,"path":71,"stem":72,"description":937,"children":-1},"Complete GitHub agent examples for every framework — AI SDK scripts, eve agents, durable Vercel Workflow routes, and Chat SDK bots you can copy and adapt.",1783444204936]