Use a fine-grained, read-only token. Refinery encrypts it for your workspace and uses it only to list and read the private repositories you selected. When you queue a repository, selected source snippets are sent to the configured OpenRouter model to draft building blocks; your token is never sent there and the drafts remain private.
Select only the repositories Refinery may read, with Contents: Read-only and Metadata: Read-only.
Use your Atlassian email and a Bitbucket API token. Refinery encrypts both for your workspace and uses them only to list workspaces and read private repositories you select. Selected source snippets go to OpenRouter only after you approve analysis.
Grant only read:workspace:bitbucket and read:repository:bitbucket. Refinery does not write to Bitbucket.
Use a GitLab personal access token with read-only read_user, read_api, and read_repository scopes. Refinery encrypts it for your workspace and uses it only to list and read private projects you select. Selected source snippets are sent to OpenRouter only after you approve analysis; drafts remain private.
read_user
read_api
read_repository
Create a token with only read_user, read_api, and read_repository. Refinery performs no project write actions.