---
title: Mint a short-lived git credential for a managed workspace repo
description: The git credential broker (WIBLO-154) behind in-sandbox native git.
api_method: POST
api_path: "/v1/workspaces/{workspaceId}/repos/credentials"
canonical_url: https://wiblo.app/docs/developers/api/repos/mint-repo-credential
last_updated: 2026-07-28T17:31:44+02:00
md_url: https://wiblo.app/docs/developers/api/repos/mint-repo-credential.md
---

# Mint a short-lived git credential for a managed workspace repo

`POST /v1/workspaces/{workspaceId}/repos/credentials`

The git credential broker (WIBLO-154) behind in-sandbox native git. The in-box credential helper POSTs the https remote git is authenticating against; when the remote is a Wiblo-managed repo REGISTERED TO THIS WORKSPACE, the broker returns a minutes-lived single-repo token (git basic-auth shape). Foreign hosts, foreign owners, and unregistered repos all collapse to 404 `REPO_NOT_FOUND` so the registry cannot be probed. The sandbox's per-session workspace key (`wbl_ephem_ws_*`) is the expected bearer from inside a sandbox; member sessions and personal tokens work identically for local tooling. NEVER store the credential — git holds it in memory per operation and asks again. Per-user rate-limited at 120/60s in its own bucket.

## Path parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `workspaceId` | `string` | Yes |  |

## Request body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `remote_url` | `string` | Yes |  |

## Request

**curl**

```bash
curl https://api.wiblo.app/v1/workspaces/{workspaceId}/repos/credentials \
  -X POST \
  -H "Authorization: Bearer $WIBLO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "remote_url": "..."
}'
```

**TypeScript**

```ts
import { createSdk, mintRepoCredential } from "@workspace/sdk"

const sdk = createSdk({ baseUrl: "https://api.wiblo.app" })

const { data, error } = await mintRepoCredential({
  client: sdk,
  path: { workspaceId: "..." },
  body: {
    "remote_url": "..."
  },
})
```

## Responses

**`200`** — A short-lived credential for exactly this repo. Returns `RepoCredentialResponse`.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `username` | `"x-access-token"` | Yes |  |
| `password` | `string` | Yes |  |
| `expires_at` | `string` | Yes |  |

**`401`** — No valid session, `wbl_*` bearer, or run token was present. Returns `ApiErrorEnvelope`.

**`404`** — Workspace not visible to the caller (`WORKSPACE_NOT_FOUND`), or the remote is not a managed repo of this workspace (`REPO_NOT_FOUND` — existence collapse). Returns `ApiErrorEnvelope`.

**`422`** — Path param failed UUID validation (`INVALID_PARAMS`). Returns `ApiErrorEnvelope`.

**`429`** — Rate limit exceeded. The body's `error.code` is `RATE_LIMITED` and `error.details.retry_after` is the same number of seconds as the `Retry-After` header. Returns `ApiErrorEnvelope`.

**`502`** — The git control plane is not configured or the host refused the mint (`UPSTREAM_UNAVAILABLE`). Returns `ApiErrorEnvelope`.