Guides

Connect a repository

Connections are how Riscly sees your system. Source providers feed the code analysis; cloud and service providers enrich the architecture map with real infrastructure.

Supported providers

Field	Type	Description
`github`	OAuth	Repository contents for analysis and, with your approval, committing fixes.
`gitlab`	OAuth / token	GitLab repositories, including SAST/SCA/secret findings.
`vercel`	token	Frontend deployments and projects (scope to selected projects).
`supabase`	token	Database / auth configuration (read-only).
`aws`	keys	Cloud configuration via signed (SigV4) read-only calls.
`stripe`	token	Optional — live MRR / active-user signal for business impact.

Connecting via OAuth (GitHub / GitLab)

In the dashboard this is a button. Programmatically, request an authorize URL for the provider and redirect the user to it; on completion the connection is attached to the project.

const { url } = await riscly(
  `/oauth/github/authorize?projectId=${projectId}`,
).then((r) => r.json());

// send the user to `url` to grant access
window.location.href = url;

Already signed in with GitHub?

If the user signed in with GitHub SSO, you can skip the separate OAuth step and connect directly from the sign-in token — the dashboard does this automatically.

Connecting with a token

Providers without an OAuth flow (e.g. Vercel, Supabase, AWS) are connected with a token or key. Secrets are masked before storage.

curl -X POST https://api.riscly.com/api/projects/PROJECT_ID/connections \
  -H "Authorization: Bearer $RISCLY_TOKEN" \
  -H "x-org-id: $RISCLY_ORG_ID" \
  -H "Content-Type: application/json" \
  -d '{"provider":"vercel","token":"VERCEL_TOKEN"}'

Scoping which projects/repos are used

For providers that expose many projects (like a Vercel org token), store non-secret config — such as the selected projects — by patching the connection's metadata:

await riscly(`/projects/${projectId}/connections/${connectionId}`, {
  method: "PATCH",
  body: JSON.stringify({ selectedProjects: ["prj_a", "prj_b"] }),
});

Disconnecting

Revoke a connection anytime from Settings → Connections or via the API. Access stops immediately.

curl -X DELETE \
  https://api.riscly.com/api/projects/PROJECT_ID/connections/CONNECTION_ID \
  -H "Authorization: Bearer $RISCLY_TOKEN" \
  -H "x-org-id: $RISCLY_ORG_ID"

PreviousAuthentication Next Scanning & the map