GitHub, GitLab & Bitbucket

Connect any combination of GitHub, GitLab, and Bitbucket from Settings → Integrations. Each is authenticated with a scoped access token rather than a full-account OAuth grant, so you control exactly what PilotX can touch.

GitHub

• Token type: fine-grained personal access token.
• Scopes: grant only Pull requests: Read and write, Contents: Read and write, and Metadata: Read-only, scoped to the specific repositories PilotX should access. Don't use a classic PAT with the broad repo scope.
• Create one from GitHub's personal access token settings.

GitLab

• Token type: project or personal access token, with the api scope.
• Use a Developer-role token, not Maintainer/Owner, so pushes stay limited to the token's own merge-request workflow. GitLab has no token scope that blocks direct pushes outright — this relies on your project's branch protection rejecting Developer-role pushes to protected branches (GitLab's default recommended setup).
• Self-hosted GitLab is supported — enter your instance URL under the connect form's advanced/optional field.

Bitbucket

• Token type: App Password.
• Scopes: check only Repositories: Read and Pull requests: Write.
• Bitbucket also requires your Bitbucket username alongside the App Password.
• Self-hosted Bitbucket Server is supported via the same optional advanced field as GitLab.

Watching repositories

Connecting a provider account authenticates PilotX against it, but doesn't hand over every repository automatically — pick which repositories to watch from the same integrations screen. Only watched repositories appear as targets when triggering a run or configuring environments.

What PilotX will and won't do

Across every provider, AutoCoder only ever proposes changes as a branch and pull request — it never pushes directly to a protected branch or merges anything itself. Every proposal goes through your repository's normal review process.