docs: Describe git credentials

platform-cloud/docs/git/overview.md

@@ -2,7 +2,7 @@
 title: "Git integration"
 description: "Connecting to Git repositories in Seqera Platform and Co-Scientist."
 date created: "2025-10-11"
-last updated: "2026-05-27"
+last updated: "2026-08-10"
 tags: [git]
 ---
 
@@ -130,9 +130,9 @@ Use an access token to connect Platform to a private [GitHub](https://github.com
 A user's personal access token (classic) can access every repository that the user has access to. GitHub recommends using fine-grained personal access tokens (currently in beta) instead, which you can restrict to specific repositories. Fine-grained personal access tokens also enable you to specify granular permissions instead of broad scopes.
 :::
 
-For personal (classic) tokens, you must grant access to the private repository by selecting the main `repo` scope when the token is created. See [Creating a personal access token (classic)](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token#creating-a-personal-access-token-classic) for instructions to create your personal access token (classic).
+For personal (classic) tokens, you must grant access to the private repository by selecting the main `repo` scope when the token is created. If the repository's organization enforces SAML single sign-on, you must also [authorize the token for that organization](https://docs.github.com/en/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on). Organizations can also block classic tokens entirely.
 
-For fine-grained tokens, the repository's organization must [opt in](https://docs.github.com/en/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization) to the use of fine-grained tokens. Tokens can be restricted by resource owner (organization), repository access, and permissions. See [Creating a fine-grained personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-fine-grained-personal-access-token) for instructions to create your fine-grained access token.
+For fine-grained tokens, the repository's organization must [opt in](https://docs.github.com/en/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization) to the use of fine-grained tokens. Tokens can be restricted by resource owner (organization), repository access, and permissions. A token created with your personal account as the resource owner can't access organization-owned repositories, regardless of its permissions. To access an organization-owned repository, create the token with the organization as the resource owner. An organization owner may need to approve the token.
 
 After you've created and copied your access token, create a new credential in Seqera:
 

platform-cloud/docs/troubleshooting_and_faqs/troubleshooting.md

@@ -15,7 +15,7 @@ This error occurs on Seqera Platform v24.2 and later when Redis is outdated. Ver
 
 #### `Unknown pipeline repository or missing credentials` from public GitHub repositories
 
-GitHub imposes [rate limits](https://docs.github.com/en/rest/overview/resources-in-the-rest-api#rate-limiting) on repository pulls, including public repositories: unauthenticated requests are capped at 60 per hour and authenticated requests at 5000 per hour. This error is usually caused by the 60-per-hour cap.
+GitHub imposes [rate limits](https://docs.github.com/en/rest/overview/resources-in-the-rest-api#rate-limiting) on repository pulls, including public repositories: unauthenticated requests are capped at 60 per hour and authenticated requests at 5000 per hour. This error is usually caused by the 60-per-hour cap. For the same error on a private organization-owned repository, see [the following entry](#github-org-repo-access).
 
 To resolve:
 
@@ -25,6 +25,31 @@ To resolve:
 
    `curl -H "Authorization: token ghp_LONG_ALPHANUMERIC_PAT" -H "Accept: application/vnd.github.v3+json" https://api.github.com/rate_limit`
 
+#### `Unknown pipeline repository or expired Git credentials` from private organization-owned GitHub repositories {#github-org-repo-access}
+
+GitHub organizations can restrict token access independently of your own repository access, and GitHub returns `404` for private repositories that a token can't access. Platform reports `401`, `403`, and `404` responses as this same error, even when the workspace credential works for user-owned repositories.
+
+Check the following:
+
+1. The repository URL is exactly `https://github.com/<org>/<repo>`, with no `.git` suffix or `/tree/<branch>` segment.
+2. The token can access the organization's repositories:
+   - Fine-grained tokens must be created with the organization as the resource owner. The organization must allow fine-grained tokens and may need to approve yours.
+   - Classic tokens require the `repo` scope and, if the organization enforces SAML single sign-on (SSO), [SSO authorization for that organization](https://docs.github.com/en/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on).
+   - GitHub Apps must be installed on the organization with access to the repository.
+
+To test the token stored in the workspace credential:
+
+```bash
+curl -sS -D - -o /dev/null \
+  -H "Authorization: Bearer <your_access_token>" \
+  -H "Accept: application/vnd.github+json" \
+  https://api.github.com/repos/<org>/<repo>
+```
+
+A `404` response means the token can't see the repository. To resolve, re-authorize or re-scope the token in GitHub. A `403` response with an `X-GitHub-SSO` header means the token needs SSO authorization. A `200` response means the token is valid. Check which credential the workspace selects in [Multiple credential filtering](../git/overview#multiple-credential-filtering).
+
+For the same error on a public repository, see [the previous entry](#unknown-pipeline-repository-or-missing-credentials-from-public-github-repositories).
+
 #### `No such variable`
 
 This error occurs when you execute a DSL1-based Nextflow workflow with [Nextflow 22.03.0-edge](https://github.com/nextflow-io/nextflow/releases/tag/v22.03.0-edge) or later.

platform-enterprise_docs/git/overview.md

@@ -2,7 +2,7 @@
 title: "Git integration"
 description: "Connecting to Git repositories in Seqera Platform."
 date created: "2024-06-24"
-last updated: "2025-07-17"
+last updated: "2026-08-10"
 tags: [git]
 ---
 
@@ -108,9 +108,9 @@ Use an access token to connect Seqera to a private [GitHub](https://github.com/)
 A user's personal access token (classic) can access every repository that the user has access to. GitHub recommends using fine-grained personal access tokens (currently in beta) instead, which you can restrict to specific repositories. Fine-grained personal access tokens also enable you to specify granular permissions instead of broad scopes.
 :::
 
-For **personal (classic)** tokens, you must grant access to the private repository by selecting the main `repo` scope when the token is created. See [Creating a personal access token (classic)](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token#creating-a-personal-access-token-classic) for instructions to create your personal access token (classic).
+For personal (classic) tokens, you must grant access to the private repository by selecting the main `repo` scope when the token is created. If the repository's organization enforces SAML single sign-on, you must also [authorize the token for that organization](https://docs.github.com/en/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on). Organizations can also block classic tokens entirely.
 
-For **fine-grained** tokens, the repository's organization must [opt in](https://docs.github.com/en/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization) to the use of fine-grained tokens. Tokens can be restricted by _resource owner (organization)_, _repository access_, and _permissions_. See [Creating a fine-grained personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-fine-grained-personal-access-token) for instructions to create your fine-grained access token.
+For fine-grained tokens, the repository's organization must [opt in](https://docs.github.com/en/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization) to the use of fine-grained tokens. Tokens can be restricted by resource owner (organization), repository access, and permissions. A token created with your personal account as the resource owner can't access organization-owned repositories, regardless of its permissions. To access an organization-owned repository, create the token with the organization as the resource owner. An organization owner may need to approve the token.
 
 After you've created and copied your access token, create a new credential in Seqera:
 

platform-enterprise_docs/troubleshooting_and_faqs/troubleshooting.md

@@ -2,7 +2,7 @@
 title: "General"
 description: "Troubleshooting Seqera Platform"
 date created: "2023-04-23"
-last updated: "2026-07-16"
+last updated: "2026-08-10"
 tags: [troubleshooting, help]
 ---
 
@@ -16,7 +16,7 @@ This error occurs on Seqera Platform v24.2 and later when Redis is outdated. Ver
 
 #### `Unknown pipeline repository or missing credentials` from public GitHub repositories
 
-GitHub imposes [rate limits](https://docs.github.com/en/rest/overview/resources-in-the-rest-api#rate-limiting) on repository pulls, including public repositories: unauthenticated requests are capped at 60 per hour and authenticated requests at 5000 per hour. This error is usually caused by the 60-per-hour cap.
+GitHub imposes [rate limits](https://docs.github.com/en/rest/overview/resources-in-the-rest-api#rate-limiting) on repository pulls, including public repositories: unauthenticated requests are capped at 60 per hour and authenticated requests at 5000 per hour. This error is usually caused by the 60-per-hour cap. For the same error on a private organization-owned repository, see [the following entry](#github-org-repo-access).
 
 To resolve:
 
@@ -26,6 +26,31 @@ To resolve:
 
    `curl -H "Authorization: token ghp_LONG_ALPHANUMERIC_PAT" -H "Accept: application/vnd.github.v3+json" https://api.github.com/rate_limit`
 
+#### `Unknown pipeline repository or expired Git credentials` from private organization-owned GitHub repositories {#github-org-repo-access}
+
+GitHub organizations can restrict token access independently of your own repository access, and GitHub returns `404` for private repositories that a token can't access. Seqera reports `401`, `403`, and `404` responses as this same error, even when the workspace credential works for user-owned repositories.
+
+Check the following:
+
+1. The repository URL is exactly `https://github.com/<org>/<repo>`, with no `.git` suffix or `/tree/<branch>` segment.
+2. The token can access the organization's repositories:
+   - Fine-grained tokens must be created with the organization as the resource owner. The organization must allow fine-grained tokens and may need to approve yours.
+   - Classic tokens require the `repo` scope and, if the organization enforces SAML single sign-on (SSO), [SSO authorization for that organization](https://docs.github.com/en/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on).
+   - GitHub Apps must be installed on the organization with access to the repository.
+
+To test the token stored in the workspace credential:
+
+```bash
+curl -sS -D - -o /dev/null \
+  -H "Authorization: Bearer <your_access_token>" \
+  -H "Accept: application/vnd.github+json" \
+  https://api.github.com/repos/<org>/<repo>
+```
+
+A `404` response means the token can't see the repository. To resolve, re-authorize or re-scope the token in GitHub. A `403` response with an `X-GitHub-SSO` header means the token needs SSO authorization. A `200` response means the token is valid. Check which credential the workspace selects in [Multiple credential filtering](../git/overview#multiple-credential-filtering).
+
+For the same error on a public repository, see [the previous entry](#unknown-pipeline-repository-or-missing-credentials-from-public-github-repositories).
+
 #### `Row was updated or deleted by another transaction (or unsaved-value mapping was incorrect)`
 
 This error occurs when incorrect configuration values are assigned to the `backend` and `cron` containers' [`MICRONAUT_ENVIRONMENTS`](../enterprise/configuration/overview#compute-environments) environment variable. You might see other unexpected behavior, such as two exact copies of the same Nextflow job submitted to the executor for scheduling.