getEphemeralRemoteURL()

Returns a JWT-authenticated remote URL targeting the +ephemeral push namespace. Refs you push through this URL stay in the ephemeral namespace—they never mirror to an upstream provider and never collide with your persistent branches until you promote them.

// Default: read/write access, 1-year TTL
const ephemeralUrl = await repo.getEphemeralRemoteURL();
// Returns: https://t:JWT@your-name.code.storage/repo-id+ephemeral.git

// Short-lived URL for a single agent run
const sandboxUrl = await repo.getEphemeralRemoteURL({
  permissions: ['git:read', 'git:write'],
  ttl: 3600,
});

// Disable force push on every ephemeral ref
const safeEphemeralUrl = await repo.getEphemeralRemoteURL({
  refPolicies: [{ pattern: 'refs/namespaces/ephemeral/*', ops: ['no-force-push'] }],
});

# Default: read/write access, 1-year TTL
ephemeral_url = await repo.get_ephemeral_remote_url()
# Returns: https://t:JWT@your-name.code.storage/repo-id+ephemeral.git

# Short-lived URL for a single agent run
sandbox_url = await repo.get_ephemeral_remote_url(
    permissions=['git:read', 'git:write'],
    ttl=3600,
)

# Disable force push on every ephemeral ref
safe_ephemeral_url = await repo.get_ephemeral_remote_url(
    ref_policies=[{"pattern": "refs/namespaces/ephemeral/*", "ops": ["no-force-push"]}],
)

// Default: read/write access, 1-year TTL
ephemeralURL, err := repo.EphemeralRemoteURL(context.Background(), storage.RemoteURLOptions{})
fmt.Println(ephemeralURL)
// Prints: https://t:JWT@your-name.code.storage/repo-id+ephemeral.git

// Short-lived URL for a single agent run
sandboxURL, err := repo.EphemeralRemoteURL(context.Background(), storage.RemoteURLOptions{
	Permissions: []storage.Permission{
		storage.PermissionGitRead,
		storage.PermissionGitWrite,
	},
	TTL: time.Hour,
})

// Disable force push on every ephemeral ref
safeEphemeralURL, err := repo.EphemeralRemoteURL(context.Background(), storage.RemoteURLOptions{
	RefPolicies: storage.RefPolicyList{
		{Pattern: "refs/namespaces/ephemeral/*", Ops: storage.Ops{storage.OpNoForcePush}},
	},
})

Options

string[]

Array of permissions. Defaults to ["git:read", "git:write"]. Accepts git:read, git:write, repo:write, and org:read. See Authentication for what each scope grants.

number

Token TTL in seconds. Defaults to 1 year.

object[]

Ordered per-ref policy rules ({ pattern, ops? }). First match wins. Ephemeral writes reach storage under a rewritten ref name, so a plain refs/heads/* pattern does not cover them. Match the namespaced form instead—refs/namespaces/ephemeral/refs/heads/main, the prefix glob refs/namespaces/ephemeral/*, or the catch-all *. The Python SDK names this option ref_policies. The Go SDK names it RefPolicies with type storage.RefPolicyList. See getRemoteURL() for available operations and the Branch Protection guide for the namespace rules.

string[]

deprecated

Repo-wide policy ops. The gateway folds them into a catch-all * rule on verify. Use refPolicies instead—see the Branch Protection guide.

Response

Returns a string containing the HTTPS Git remote URL with embedded JWT authentication:

https://t:{jwt}@{org}.code.storage/{repo-id}+ephemeral.git

Usage

Use the URL as a standard Git remote. Push and fetch work with ordinary Git commands:

git remote add ephemeral <url>
git push ephemeral feature-branch
git fetch ephemeral feature-branch

The remote advertises ephemeral refs only. A fetch through it never shows your persistent branches, and a fetch through the repository remote never shows ephemeral ones.

See the Ephemeral Branches guide for promotion workflows and the Sandboxes guide for agent isolation patterns.

Getting Started

Guides

Reference

Options

Response

Usage

​Options

​Response

​Usage

Options

Response

Usage