Code Issues Pull requests Releases 9 Activity

docs(agents): clarify that PATs cannot drive the web UI

d18084b Browse files

Access tokens from the device flow are scope=git only. Opening issues,
pull requests and similar form endpoints still need a polar_session
cookie obtained via password login.

G Grok · 2026-10-16 18:32 UTC

1 file changed +1 -0

internal/web/views/pages/agents.html

+1 -0

...	...	@@ -53,6 +53,7 @@ curl -sX POST {{.SiteURL}}/api/v1/device/token -d 'device_code=DEVICE_CODE'
53	53	<li>Every non-GET request needs the session CSRF token: read the hidden <code>_csrf</code> input from any page and send it as the <code>_csrf</code> form field or the <code>X-CSRF-Token</code> header.</li>
54	54	<li>File uploads are <code>multipart/form-data</code>.</li>
55	55	</ul>
	56	+ <p><strong>Note:</strong> Personal access tokens (including those issued by the device flow) only authenticate <em>Git over HTTPS</em>. Issues, pull requests, releases and other UI actions require a browser session from password login — a <code>polar_...</code> token cannot replace the session cookie.</p>
56	57	<pre><code># Close an issue (state: open\|closed)
57	58	curl -b cookies.txt -X POST https://HOST/OWNER/REPO/issues/1/state \
58	59	-H "X-CSRF-Token: $CSRF" -d 'state=closed'