How to browse a private GitHub repo without cloning it
Public repos work with zero setup, but private repos need one extra step: proving to GitHub's API that you're actually allowed to see them. Here's exactly what that involves and why it's safe.
Why private repos need an extra step at all
GitHub's API simply refuses to return any data — file sizes, tree structure, contents — about a private repository unless the request is authenticated as someone with access. This isn't a RepoKit limitation, it's GitHub's own access control working exactly as intended. So any tool that wants to show more than a bare page title for a private repo needs some form of credentials.
RepoKit detects it's private and can't yet read it, and shows a connect prompt instead of guessing or failing silently.
Click "Connect GitHub"
You're taken to GitHub's own token-creation page with a minimal, read-only scope pre-selected.
Generate the token and paste it back
Some flows detect it automatically from your clipboard; otherwise paste it into RepoKit's prompt directly.
Browse normally
Every RepoKit feature — sizes, search, downloads, copy, duplicate detection — now works on this repo and every other private repo your account can access.
Where the token goes (and doesn't)
It's stored locally in your browser's extension storage and attached only to requests going directly to api.github.com. There is no RepoKit server for it to pass through — this extension has no backend at all.
Revoking access later
Because it's a standard GitHub personal access token, you can revoke it anytime from your GitHub account's developer settings — the same as removing access for any other third-party tool — instantly cutting off RepoKit's ability to read private data, independent of anything the extension itself does.
Frequently asked questions
Is it safe to paste a GitHub token into a browser extension?+
It's safe specifically because of how the token is scoped and stored: create it with read-only repository access (never admin or write scopes), and it's kept in Chrome's local extension storage on your own device, sent only directly to GitHub's API — never to any RepoKit-operated server, because none exists in this architecture.
Do I need a separate token for every private repo?+
No — one token connected once applies to every private repository your GitHub account already has access to, the same way your github.com login session works across all your repos.
What if I don't want to create a token at all?+
You can dismiss the prompt and keep browsing normally — RepoKit simply won't show sizes, search, or downloads on that specific private repo, while continuing to work fully on any public repos you visit.
Repo