# How to Set Up a GitHub Token for Authenticated API Access in Agent-Reach > Learn how to set up a GitHub token for authenticated API access in Agent-Reach easily. Follow our guide to secure your API calls and streamline your workflow. - Repository: [Pnant/Agent-Reach](https://github.com/Panniantong/Agent-Reach) - Tags: how-to-guide - Published: 2026-07-13 --- **To set up a GitHub token for authenticated API access in Agent-Reach, use the CLI command `python -m agent_reach.cli config set github-token ` or manually edit the `~/.config/agent-reach/config.yaml` file to include the `github_token` key.** Agent-Reach is an open-source automation tool that interacts with the GitHub API for operations like release monitoring and repository queries. Without authentication, the tool hits strict rate limits and cannot access protected endpoints. This guide explains how to configure your personal access token using the built-in configuration system, based on the implementation in `Panniantong/Agent-Reach`. ## Why Authenticated Access Matters Agent-Reach makes HTTP requests to the GitHub API that require an **Authorization** header. Without a valid token, GitHub returns "unauthenticated" errors and applies a low rate limit of 60 requests per hour. By storing a GitHub token in the configuration, the tool transparently injects a `Bearer ` header into every request via the `_github_get_with_retry` helper in [`agent_reach/cli.py`](https://github.com/Panniantong/Agent-Reach/blob/main/agent_reach/cli.py), allowing for 5,000 requests per hour and access to private repository data. ## Setting Up the GitHub Token via CLI ### The Config Set Command The recommended way to store your token is using the built-in CLI interface. The command parses the `github-token` subcommand and writes the value to the persistent configuration store: ```bash python -m agent_reach.cli config set github-token ghp_YourGeneratedTokenHere ``` Behind the scenes, this command invokes `config.set("github_token", value)` defined in [`agent_reach/config.py`](https://github.com/Panniantong/Agent-Reach/blob/main/agent_reach/config.py). ### Implementation Details In [`agent_reach/cli.py`](https://github.com/Panniantong/Agent-Reach/blob/main/agent_reach/cli.py), the CLI argument parser handles the `config set` command and validates the input before passing it to the Config class. The key is stored internally as the string `"github_token"` (underscore), even though the CLI accepts the hyphenated version `github-token` for usability. ## Manual GitHub Token Configuration ### Editing the YAML Config File If you prefer file-based configuration or need to automate setup across multiple machines, you can write the token directly to the YAML configuration file. The file resides at: ```text ~/.config/agent-reach/config.yaml ``` Add the following line to the file: ```yaml github_token: ghp_YourGeneratedTokenHere ``` The `Config` class in [`agent_reach/config.py`](https://github.com/Panniantong/Agent-Reach/blob/main/agent_reach/config.py) reads this value on demand using `config.get("github_token")`, ensuring the token is available to all components without environment variables. ## How Agent-Reach Uses Your Token ### The Authorization Header When the tool needs to query the GitHub API, it retrieves the stored token and constructs an authenticated request. The internal helper `_github_get_with_retry` in [`agent_reach/cli.py`](https://github.com/Panniantong/Agent-Reach/blob/main/agent_reach/cli.py) implements the logic: ```python headers = {"Authorization": f"Bearer {github_token}"} resp = requests.get(url, headers=headers) ``` This pattern ensures that every API call carries the necessary credentials, preventing 401 Unauthorized responses and rate-limit throttling. ## Security Best Practices The token is stored only in the local configuration file and is never logged to stdout or written to log files. To protect this sensitive data: - Restrict file permissions to owner-only: `chmod 600 ~/.config/agent-reach/config.yaml` - Never commit the config file to version control - Use a fine-grained personal access token with minimal scopes (e.g., `repo` read-only access) rather than a classic token with broad permissions ## Verifying the Configuration To confirm the token is correctly stored, retrieve it via the CLI: ```bash python -m agent_reach.cli config get github-token ``` If configured correctly, the output displays the token value. You can also verify programmatically: ```python from agent_reach import config token = config.get("github_token") print(f"Token configured: {token[:4]}..." if token else "No token found") ``` ## Summary - **Store the token** using `python -m agent_reach.cli config set github-token ` which calls `config.set("github_token", value)` in [`agent_reach/config.py`](https://github.com/Panniantong/Agent-Reach/blob/main/agent_reach/config.py). - **Manual alternative** involves editing `~/.config/agent-reach/config.yaml` and setting the `github_token` key. - **Internal usage** occurs in [`agent_reach/cli.py`](https://github.com/Panniantong/Agent-Reach/blob/main/agent_reach/cli.py) where the `_github_get_with_retry` function adds the `Bearer ` header to GitHub API requests. - **Security** requires `chmod 600` on the config file to prevent unauthorized access. ## Frequently Asked Questions ### How do I generate a GitHub personal access token? Navigate to GitHub Settings > Developer settings > Personal access tokens > Fine-grained tokens. Generate a new token with at least "Read" access to repositories that Agent-Reach needs to monitor. Copy the token string (starting with `ghp_`) and use it with the CLI command or YAML configuration. ### What permissions does the token need? For basic repository queries and release checks, the token only requires **read-only access to repositories**. If Agent-Reach needs to create issues or pull requests, you must grant additional read-write permissions. Always follow the principle of least privilege when generating tokens. ### Where is the configuration file stored on Windows? On Windows systems, the configuration file is located at `%APPDATA%\agent-reach\config.yaml` instead of the Unix `~/.config/` path. You can open this location by running `explorer %APPDATA%\agent-reach` in the command prompt. ### Why do I still see "unauthenticated" errors after setting the token? This usually indicates the token was not saved to the correct key. Verify that [`agent_reach/config.py`](https://github.com/Panniantong/Agent-Reach/blob/main/agent_reach/config.py) contains the key `"github_token"` (underscore) and not `"github-token"` (hyphen) when retrieved via `config.get()`. Also ensure the YAML file has no indentation errors and that you have restarted the Agent-Reach process after configuration.