Tokens
RW
One per owner. The only way to move a card. What a token reaches
is badged RW or
RO in the picker.
Create a token, already set
to Issues read and write plus Metadata read. Under
Resource owner pick your account
or an organization. The link asks for 30 days: an
organization that caps token lifetime refuses anything above its
cap outright, and a short lifetime also limits how long a stolen
token is worth anything. If an organization rejects your token,
the fix is a shorter lifetime, not a longer one. Tokens stay in
this browser and are sent only to api.github.com.
Revoke beside a token ends it at GitHub for
good; the bin only makes this browser forget it.
An organization that restricts fine grained tokens does not
appear here at all, not even for reading, and GitHub cannot list
which ones those are. Add it under Public instead.
Do not take this page's word for anything, including
this paragraph.
Whoever serves this page chooses the code your browser runs, and
can choose differently tomorrow, or for one visitor. Nothing on
the page can prove otherwise. What you can do:
- Do not sign in at all. Public
repositories and whole organizations work with no token,
under Public below.
- Run your own copy.
git clone https://github.com/fmaste/quadrants,
then open index.html from disk. There is no
build step, so the clone is the whole program and it talks
to GitHub directly.
- Check this deployment against that source.
From the clone,
python3 verify.py site <this url>
fmaste/quadrants reads the commit GitHub reports as
deployed and compares every served file with it. It proves
the bytes you got now are a reviewable commit; it cannot
promise the next request.
Where this is hosted matters. Browser storage
is shared by every page on one origin, so on
user.github.io any other site that account
publishes can read these tokens. A dedicated domain, or an
account that hosts nothing else, is the only thing that isolates
them.