Golf sign-in
Portable Golf passwords are independent of Forgejo passwords. Hosted Access identifies an enrolled account, then Golf checks current grants.
GOLF Field guides / Identity
Different credentials. Different jobs.
Separate product sign-in, Git transport, execution/model entitlement and provider resource authority.
Developer preview · capability review October 14, 202601 / IDENTITY
Use the credential for its intended boundary.
Keep real secrets out of source, chat, URLs and shell arguments.
Git and machine access
Use displayed clone URLs and supported Git credentials. Native machines additionally need approved Access transport. The Golf CLI uses GOLF_FORGE_TOKEN, GOLF_API_TOKEN or native mode as documented.
Model and infrastructure access
A coding-agent account is not a repository grant. Provider API authority stays brokered; jobs receive only approved exact-source values in the bounded profile.
02 / REVOCATION
End the authority you intended to end.
These lifecycles are related but separate.
Sessions and delegation
Terminating a source session invalidates its delegated Golf credentials. It does not revoke every native PAT, Git key or provider consent.
Running work
Admission, running-lease and publication boundaries differ. A repository run switch applies at admission and does not cancel already admitted work.
Keys and restore
Preserve encryption keys and stored material identity. Rotation and provider-specific recovery require explicit documented procedures.
Make your first move.
Explore the hosted public repository, request enrollment for private workflows, or start your own portable installation.