# GitOky Git CLI authentication

## For coding agents: connect this machine first

If this machine has no GitOky credential, or git answers 401/403 (UNAUTHENTICATED, CREDENTIAL_SCOPE_DENIED), do not ask the user for a key. The machine needs its own device key, approved by the user in the browser (repositories and read/write access). In order of preference:

1. Oky Desktop (preferred on a desktop computer). If it is installed and signed in, git already works here: the sign-in registers the key as the git credential for gitoky.com. If it is not installed, ask the user to install it from https://gitoky.com/downloads and sign in from the app's account menu. More repositories later: the app's account menu, "이 컴퓨터의 레포 권한 바꾸기".
2. The goky CLI, where Oky Desktop is not an option (servers, macOS/Linux, agent-only machines). Install on Windows: irm https://gitoky.com/goky/install.ps1 | iex  (if you cannot run executables, ask the user to run that line). Then:

  goky auth login

Full steps: https://gitoky.com/docs/agents

With goky, show the printed URL and confirmation code to the user. Exit code 3 means still waiting: run the same command again after the user approves. After exit code 0, plain git clone/pull/push work for the approved repositories. If a repository is still refused, run goky auth login --update (the owner approves more repositories for the same key) or the user adds it at the manage URL that goky printed.
Machine-readable discovery: https://gitoky.com/.well-known/agent.json

## Manual credentials

GitOky supports standard Git Smart HTTP. Browser login cookies are separate from Git CLI credentials.

Clone a private repository:
  git clone https://gitoky.com/OWNER/REPOSITORY.git

At the local Git credential prompt enter:
  Username: your GitOky account name
  Password: a Deploy Key, Repo Key, or Personal Access Token

Choose the narrowest key:
- Repo Key: exactly one repository; create it in that repository's Settings page.
- Deploy Key: selected projects; create it at https://gitoky.com/settings/keys.
  repo.read permits clone/pull. git.push permits push.
- Personal Access Token: account-level CLI access.

Project-scoped Deploy Keys may last up to three years. Unscoped Deploy Keys are limited to one year.

Security:
- Never paste an access key into an AI chat.
- Never embed a key in a clone URL, shell command, repository file, or ~/.ssh.
- Enter it only in Git's local credential prompt and store it with the OS credential manager.

If a push returns REPO_NOT_FOUND, read https://gitoky.com/.well-known/agent.json.
When repository_creation is supported, ask the user before opening the browser approval URL.
The resulting goky_rc_ credential can create only the one approved repository; it cannot push.

For repository-specific credentials:
  git config --global credential.https://gitoky.com.useHttpPath true

# GitOky LLM gateway

OpenAI-compatible inference for GitOky LLM keys: base URL https://gitoky.com/v1.
Model names are branches named for the model (e.g. "qwen3-coder-30b"); the
older role names ("code", "quality" …) are aliases of them and still work.
Some models (e.g. "claude-opus-5.5", alias "quality") are closed by default for cost reasons. If a model
is missing from GET /v1/models or a request returns 403 branch_not_entitled,
read https://gitoky.com/docs/llm before retrying — use "auto" instead.
No key yet? Do not ask the user to paste one: POST
https://gitoky.com/api/v1/agent/llm-key-requests and have the user approve it
in the browser (details under "Getting a key as an agent" in /docs/llm).