ConsoleBook a demo
Guides

Deploy from a private repo

One GitHub App install, then private repos deploy like public ones. No deploy keys, no PATs.

Private GitHub repos deploy through the nyxory GitHub App: a one-time install in your browser, then every clone — interactive or inside a build — authenticates with short-lived tokens we mint per operation. You never create a deploy key or a PAT, and there’s nothing to rotate.

Prereqs

  • An agent connected to nyxory (see Connect your agent)
  • Admin access to the GitHub repo or org you want to connect
  • Works for github.com repos; for GitLab / Bitbucket / self-hosted, talk to us

  1. Just prompt.

    deploy https://github.com/me/private-widget to nyxory

    Your agent calls nyx_brain, then tries the clone. For a public repo that’s the end of the story — for a private one, the clone bounces with an auth error.

  2. The agent hands you an install link.

    On the bounce, the agent calls nyx_github_install_url and gives you a signed install URL. The link expires after 10 minutes — if it goes stale, the agent just mints a fresh one; the call is idempotent.

  3. Install the app in your browser.

    Open the link, pick the repositories you want nyxory to reach (or select the whole org), click Install. It’s a regular GitHub App: repo-scoped, visible under your GitHub settings, revocable there at any time.

  4. Tell your agent you’re done.

    It retries the clone via nyx_clone_repo — the repo lands in your project workspace and the deploy continues exactly like a public-repo deploy. If several installations cover the same owner, the agent disambiguates with nyx_list_github_installations and nyx_list_github_repos.

  5. Builds are covered automatically.

    Container builds run in an isolated build environment that needs to clone your repo too. The platform mints a short-lived (~1 hour) token per build, scoped to the clone step only — your Dockerfile never sees it, it’s never stored, and it expires on its own.

Managing access

which GitHub accounts are connected to nyxory?

Your agent lists them via nyx_list_github_installations. To revoke:

  • From the agent: nyx_disconnect_github revokes the installation on GitHub and removes our record. Idempotent — safe to call twice.
  • From GitHub: Settings → Applications → Installed GitHub Apps → nyxory → Uninstall. Same effect.

After either path, no new tokens can be minted for that installation. Outstanding short-lived tokens age out within the hour.

Troubleshooting

Caution:

  1. The install link 404s or errors. It expired (10-minute window). Ask your agent for a fresh one — nyx_github_install_url re-signs on every call.
  2. Installed, but the clone still fails. Check the repo was actually included in the installation: ask your agent to run nyx_list_github_repos for the installation — the repo’s full_name must appear there. If you picked “selected repositories” during install, add the missing repo from GitHub’s app settings.
  3. Multiple orgs, wrong account. The install link binds to whichever GitHub account you’re logged into. Log into the right account (or use the org picker on GitHub’s install screen) and re-open a fresh link.
  4. Org requires approval. In orgs where you’re not an admin, GitHub queues the install as a request. The clone succeeds as soon as an org admin approves the request — that approval lives on GitHub’s side, so nudge the admin rather than re-running the install.
  5. Still stuck? Ask your agent for the exact clone error and the output of nyx_list_github_installations — that pair is what we’ll ask for in support.

Next steps
Ask any AI about nyxory