Tensorlake Documentation

Most users only need one command:

tl login

tl login opens a browser, authenticates your account, and stores a local CLI token. After that, tl git commands mint the short-lived credentials they need automatically. For plain git in a worktree, run tl git setup once. See Set Up Plain Git. You only handle a Git credential yourself in CI or another HTTP client.

How Authentication Fits Together

There are two layers. SDKs and direct API clients use API keys; the CLI can use the same API key or the PAT stored by tl login:

Layer	What it is	Used by
Tensorlake API auth	A project-scoped API key. This authorizes SDK and direct API calls.	Python and TypeScript SDKs, REST clients
Tensorlake CLI auth	An API key or personal access token.	`tl login`, `tl git`, other `tl` commands
Git credential	A short-lived credential minted for repository access. This authorizes repository operations.	`git clone`, `git push`, SDK calls, `tl git` mounts

Your CLI/API credential is not sent to Git. Tensorlake uses it to mint a Git credential, then Git clients and mounts use that Git credential against the repository service.

How Git Credentials Work

When a command needs repository access:

The CLI authenticates to Tensorlake with your local CLI token, API key, or PAT.
Tensorlake checks the current project and authorized principal.
Tensorlake mints a short-lived Git credential for that principal.
The Git service verifies the credential’s signature, project, repo pattern, expiration, revocation status, and scopes on each request.

The credential contains:

Field	Meaning
`gitUsername`	The Git username. It is always `t`.
`token`	The password Git sends with HTTP Basic auth.
`expiresAt`	When the credential stops working.
`repoPattern`	The repository or repository pattern the credential can access.
`scopes`	The operations the credential can perform.

Most CLI paths mint a repo-scoped credential. That keeps clone, push, snapshot, and promotion operations narrow to the repository they are working on.

Mint a Git Credential

$ tl git token agent-outputs
project: project_9f3c2a1b
repo: agent-outputs
username: t
password: eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJwcm9qZWN0XzlmM2MyYTFiIiwicmVwbyI6ImFnZW50LW91dHB1dHMifQ.Kx9f... (truncated)
expires: 2026-07-07T13:00:00Z
scopes: git:read, git:write

Remote URL
  https://git.tensorlake.ai/project_9f3c2a1b/agent-outputs

Use this credential with Git or SDK clients
  username: t
  password: the token above

The username is always t. The password is the token.

Use It With Git

Credential store
Embed in URL

Cache the credential with Git’s credential helper:

git config --global credential.helper store
git clone https://git.tensorlake.ai/project_9f3c2a1b/agent-outputs
Username for 'https://git.tensorlake.ai': t
Password for 'https://t@git.tensorlake.ai': <paste the token>

Git remembers the credential for later commands against the same remote.

Put the token directly in the remote URL for scripts and CI:

TOKEN=$(tl git token agent-outputs --json | jq -r .token)

git clone https://t:$TOKEN@git.tensorlake.ai/project_9f3c2a1b/agent-outputs

Or update an existing remote:

git remote set-url origin https://t:$TOKEN@git.tensorlake.ai/project_9f3c2a1b/agent-outputs
git push origin main

Treat a token in a URL or credential store like any other secret. It expires automatically, but it should not be committed, logged, or shared.

Set Up Plain Git

tl git setup makes git fetch and git push in one worktree authenticate on their own. Run it once in the repository:

cd agent-outputs
tl git setup                   # repo name defaults to the directory name
tl git setup my-repo           # name the repo
tl git setup --create          # create the repo if it does not exist
tl git setup --remote origin   # name the remote; default is tl

The command does three things:

Adds a remote named tl that points at the repository URL. If a remote already points there, for example the origin left by tl git clone, it reuses that remote.
Registers tl git credential-helper in the repository’s local Git config, scoped to the Tensorlake Git host. Git runs the helper on each fetch and push. The helper mints a repo-scoped credential and caches it until it expires.
Runs git ls-remote against the remote to prove the setup works.

The output ends with the remote URL:

configured: plain `git` now authenticates against https://git.tensorlake.ai/project_9f3c2a1b/agent-outputs
  try: git push tl <branch>

Git must find tl on its PATH. The helper line uses the bare name tl when it is on PATH, and the full path to the binary otherwise.

The helper is pinned to a context

The helper line in .git/config carries the context and organization that ran setup:

helper = !tl --context default --organization org_1a2b3c git credential-helper

A context token works for one project only, so the repository keeps the context that owns its project. tl context use does not change which context Git uses. To move a repository to another context, run setup again in that context:

tl --context staging git setup

Setup fails when the repository is not in that context’s project.

When the helper cannot authenticate

The helper never makes Git fail hard. It prints the reason on stderr, exits 0, and Git falls back to a password prompt. Press Ctrl-C, fix the cause, and retry.

stderr says	Cause	Fix
tl: not logged in; run `tl login` (or set TENSORLAKE_API_KEY) and retry	`tl logout` removed the token and the cached Git credentials.	`tl login --context <name>`
tl: unknown context '<name>' (from --context flag). ... run `tl git setup` in the repo again	The context in the helper line was deleted or renamed.	Run `tl git setup` again.
tl: cannot determine the TensorLake project for this URL; run `tl git setup` in the repo	The remote URL has no project path.	Run `tl git setup` again.

To stop Git from prompting in scripts, set GIT_TERMINAL_PROMPT=0. Git then fails with an authentication error instead.

Scopes

Every credential carries one or more scopes:

Scope	Grants
`git:read`	Clone, fetch, and read-only mount
`git:write`	Push, snapshot, and promote. Implies `git:read`.
`repo:write`	Create, fork, delete, archive, and restore repositories
`project:read`	List and read every repository in the project. Implies `git:read`.
`project:admin`	Project administration, workspace fleet management, quotas, and operation history. Implies `project:read` and `git:read`.

tl git token <repo> mints git:read and git:write for that repository only. It is enough to clone, push, snapshot, and promote. It cannot create, delete, or list other repositories. Repo-scoped credentials cannot create repositories, delete repositories, manage keys, or revoke tokens.

Token Lifetime

Git credentials are short-lived by design. The default lifetime is one hour. When a token expires, mint a new one:

tl git token <repo>

tl git mounts handle this automatically. The CLI caches fresh Git credentials for later commands and a running mount daemon rotates its credential before expiry. For the full plain Git workflow, see Use with Git.

Git Repositories

Mint a credential, clone, branch, commit, merge, and push.

Platform Authentication

API keys, personal access tokens, SSO, and broader Tensorlake API authentication.

Overview

Guides

Reference

Use Cases

Authentication

How Authentication Fits Together

How Git Credentials Work

Mint a Git Credential

Use It With Git

Set Up Plain Git

The helper is pinned to a context

When the helper cannot authenticate

Scopes

Token Lifetime

Git Repositories

Platform Authentication

​How Authentication Fits Together

​How Git Credentials Work

​Mint a Git Credential

​Use It With Git

​Set Up Plain Git

​The helper is pinned to a context

​When the helper cannot authenticate

​Scopes

​Token Lifetime

Git Repositories

Platform Authentication

How Authentication Fits Together

How Git Credentials Work

Mint a Git Credential

Use It With Git

Set Up Plain Git

The helper is pinned to a context

When the helper cannot authenticate

Scopes

Token Lifetime