GitHub access

Drafting an invoice needs your commit history from somewhere. There are three ways to provide it, listed here from the most convenient to the most locked down.

Last updated November 12, 2026

Connect with GitHub

On the Repos page, choose Connect with GitHub and approve the request. Your repos then appear in a list, and you pick the ones you bill from.

Note

GitHub’s permission for this is broad. It is called repo, and it covers every repository you can reach, private ones included, for reading and writing. This product only ever reads commit history with it, but the permission itself is wider than that. If that is more than you or your client are comfortable with, use a fine-grained token instead.

A fine-grained token

A fine-grained personal access token lets you choose exactly which repositories it covers and grant read access only. It is also the way through when a client’s organization blocks third-party apps.

On GitHub, open Settings → Developer settings → Personal access tokens → Fine-grained tokens and generate a new one.
Select only the repositories you bill from.
Under repository permissions, set Contents to read-only. Metadata is added automatically.
Paste the token on the Repos page.

No connection at all

You don’t have to connect anything. Run the command-line tool inside a repo and it reads your local history, or paste the output of git log on the Generate page. Both work for repos on GitLab, Bitbucket or nowhere but your own machine.

What is read

Commit messages, dates and authors, and how many files each commit touched. The security page has the full list and says where each piece goes.

Taking access away

Remove the token on the Repos page, which deletes the stored copy.
If you connected with one click, also revoke the app on GitHub under Settings → Applications → Authorized OAuth Apps.
If you used a fine-grained token, delete it on GitHub where you created it.