# Sites Git credentials: secure authentication from Codex and token revocation behavior

**URL:** <https://community.openai.com/t/sites-git-credentials-secure-authentication-from-codex-and-token-revocation-behavior/1397673>\
**Category:** ChatGPT\
**Tags:** macos, codex-app, sites\
**Created:** [September 15, 2026, 4:26am UTC](https://community.openai.com/t/sites-git-credentials-secure-authentication-from-codex-and-token-revocation-behavior/1397673 "2026-09-15T04:26:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![james.davison](https://avatars.discourse-cdn.com/v4/letter/j/c5a1d2/32.png) [@james.davison](https://community.openai.com/u/james.davison)\
**Post date:** [September 15, 2026, 4:26am UTC](https://community.openai.com/t/sites-git-credentials-secure-authentication-from-codex-and-token-revocation-behavior/1397673/1 "2026-09-15T04:26:41Z")

</div>

We’re trying to deploy an existing ChatGPT Site from Codex Desktop on macOS. The source and build are tested, and the Sites connector successfully issues a short-lived repository write credential through `create_source_repository_write_credential`.

Authentication worked for a read-only Git operation. However, Codex’s automatic approval review rejected a push because passing the Bearer token through `git -c http.extraHeader=...` exposes it in the execution-tool transcript.

Git supports `--config-env=http.extraHeader=SITES_AUTH_HEADER`, but we haven’t found a supported way to transfer the connector-issued token into that environment variable without including it in another logged tool argument.

Could OpenAI clarify:

1. What is the supported way to securely authenticate a Sites source push from Codex Desktop?

2. Does issuing a new source-repository credential immediately revoke the previous token, or can both remain valid until their respective expiration times?

3. Is there an explicit revocation operation for these credentials?

4. Is there a supported upload or publishing flow that handles source authentication internally?

We’re asking specifically about **Sites source-repository write tokens** , not OpenAI API keys, ChatGPT login tokens, or Site visitor authentication.

---

<div class="post-metadata">

**Author:** ![james.davison](https://avatars.discourse-cdn.com/v4/letter/j/c5a1d2/32.png) [@james.davison](https://community.openai.com/u/james.davison)\
**Post date:** [September 15, 2026, 8:30am UTC](https://community.openai.com/t/sites-git-credentials-secure-authentication-from-codex-and-token-revocation-behavior/1397673/2 "2026-09-15T08:30:54Z")

</div>

By using the CLI in codex it worked (AI steps):

Here’s how authentication worked:

1. Requested a short-lived, repository-scoped token from the Sites connector.
2. Held the response in tool-session memory without printing it.
3. Passed the token to Git through a command-scoped environment variable, using --config-env=http.extraHeader=SITES\_AUTH\_HEADER.
4. Disabled shell tracing with set +x and redacted the token from returned command output.
5. Cleared the stored credential afterward.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/openai1/original/4X/8/7/c/87c2e81543bbb01aa9641aeef8fe14cab5e9590a.png) [@system](https://community.openai.com/u/system)\
**Post date:** [September 18, 2026, 8:31am UTC](https://community.openai.com/t/sites-git-credentials-secure-authentication-from-codex-and-token-revocation-behavior/1397673/3 "2026-09-18T08:31:10Z")

</div>

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.