Git over HTTPS
HTTPS repository URLs share the core origin:
https://dev.gitdown.io/u/<OWNER>/r/<REPOSITORY>.githttps://dev.gitdown.io/o/<ORGANIZATION>/r/<REPOSITORY>.gitThe URL map selects Git only from smart-protocol wire signatures; browser repository pages on the same path space remain SPA routes.
Human PAT
Section titled “Human PAT”Git uses HTTP Basic. Supply the Gitdown user identity requested by your client as the username and the human PAT as the password. Never embed either secret in the remote URL.
git clone https://dev.gitdown.io/u/<OWNER>/r/<REPOSITORY>.gitLet the client’s credential helper prompt or retrieve the PAT from protected storage. A Firebase bearer token is not a Git password.
Bot token
Section titled “Bot token”Bots use the exact fixed Basic username gitdown-bot and a grant-bound bot access token as the password. That username selects bot verification terminally; a rejected bot credential cannot fall through to human PAT logic.
Every request reloads live bot, credential, grant, authorizing-subject, repository reach, and git:fetch or git:push authority. Commit author text is metadata, not authenticated attribution. Normal repository controls remain active: git:push never permits force-push, deletion, or rewrite of main.