# MakeCode vs GitHub tokens

**URL:** https://forum.makecode.com/t/makecode-vs-github-tokens/427
**Category:** PXT
**Created:** [August 9, 2019, 11:24pm UTC](https://forum.makecode.com/t/makecode-vs-github-tokens/427 "2019-08-09T23:24:58Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![kjw](https://avatars.discourse-cdn.com/v4/letter/k/e79b87/32.png) [@kjw](https://forum.makecode.com/u/kjw)
#### Post date: [August 9, 2019, 11:24pm UTC](https://forum.makecode.com/t/makecode-vs-github-tokens/427/1 "2019-08-09T23:24:58Z")

</div>

I see there’s a way to access GitHub repositories for both read and write from the MakeCode editor and this involves GitHub’s personal access token feature. The text in the editor suggests `repo` or `public_repo`, both being “full access” scopes.

Where are these tokens stored and where are they trasmitted when they are used on [https://arcade.makecode.com/](https://arcade.makecode.com/) for example?

---

<div class="post-metadata">

### Author: ![jwunderl](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.makecode.com/jwunderl/32/5308_2.png) [@jwunderl](https://forum.makecode.com/u/jwunderl)
#### Post date: [August 10, 2019, 12:09am UTC](https://forum.makecode.com/t/makecode-vs-github-tokens/427/2 "2019-08-10T00:09:05Z")

</div>

It’s stored in local storage ([implementation in pxt](https://github.com/microsoft/pxt/blob/master/pxteditor/localStorage.ts)) in the browser, then used in the [request url to GitHub](https://github.com/microsoft/pxt/blob/2e114cb5a4782d0444ca3aa95959c51627ff2b94/pxtlib/github.ts#L91). It’s queried from local storage [here](https://github.com/microsoft/pxt/blob/2e114cb5a4782d0444ca3aa95959c51627ff2b94/webapp/src/app.tsx#L3765). The token is also used to identify which elements to show in a few react components (for example, whether to show the [github extension](https://github.com/microsoft/pxt/blob/2e114cb5a4782d0444ca3aa95959c51627ff2b94/webapp/src/projects.tsx#L738) option when importing a file).

If you want to look into it a bit more, here’s the place where the core GitHub interactions are defined: [https://github.com/microsoft/pxt/blob/master/pxtlib/github.ts](https://github.com/microsoft/pxt/blob/master/pxtlib/github.ts) you can pull down the repo and start looking there to see how things are implemented / used exactly.

Also, here’s the documentation for github extensions for anyone curious [https://makecode.com/extensions/github-authoring](https://makecode.com/extensions/github-authoring)

---

<div class="post-metadata">

### Author: ![mmoskal](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.makecode.com/mmoskal/32/20_2.png) [@mmoskal](https://forum.makecode.com/u/mmoskal)
#### Post date: [August 10, 2019, 6:30pm UTC](https://forum.makecode.com/t/makecode-vs-github-tokens/427/3 "2019-08-10T18:30:24Z")

</div>

In particular the token is only stored in the browser and sent only to [github.com](http://github.com) not [makecode.com](http://makecode.com).
