A product that hands its own customers a git repository has had to run a git server. Cloudflare Artifacts removes the server. It is versioned storage that speaks Git, reachable by any git client, readable from a Worker.
It does not remove the work on top. Who owns a repository. Who may read and who may push. How a token’s life ends. How a git client gets one. Every product builds those four, and builds them the same way.
@pithy-sh/artifacts builds them once.
What it gives you
- An owner. A person, or an organization when
organizationis composed. - A grant per person.
readorwrite, because Artifacts’ token scope has exactly two values and no role vocabulary maps onto two values by itself. An owner always haswrite. Nothing else gives access. - Short-lived tokens. Minted against the grant, fifteen minutes by default and never more than an hour.
- A record of who holds each one. The kit records every token it mints and who it was minted for, never its value.
- A credential helper. A git client mints a fresh token per operation with your app’s own credential. The helper is a page of shell.
- In-Worker reads. History, commits, trees, blobs and files, for an app that versions its own content and never exposes git.
- A management view. A management client reads every repository, its grants, history and tokens, and revokes one token or every live one, with a reason.
- A namespace per environment. Production’s repositories never sit beside a feature’s, and
pithy feature destroyreaps a feature’s.
A stranger’s 404 is a missing repository’s 404
A namespace is flat. There is no / in a repository name, so one tenant’s docs would collide with another’s, and the conflict that reported it would tell a stranger the name exists.
So a repository has two names. The physical name is in the clone URL, and it is a random UUID: it cannot collide, and nobody can guess it. The display name is the label your customers see, unique per owner and nowhere else.
A caller with no grant gets a 404 byte-identical to the one for a repository that does not exist. A caller who can see a repository and may not do something to it gets a 403, because by then they already know it is there.
The TTL is the revocation window
Removing a grant does not revoke a token already minted. A token minted for somebody keeps working until it expires, whatever happens to their grant. So its life is how long a removed person keeps pushing. That is why it is short, and why the ceiling is an hour, refused at boot.
To end it sooner, the owner revokes every live token on the repository at once. Everybody else’s helper mints again on its next operation. The person whose grant is gone cannot.
Cloudflare’s token metadata names no holder, so the kit records every token it mints: its id, the repository, the person it was minted for, its scope and its expiry, and never the token itself. So who can still push has an answer. A management client lists a repository’s tokens with their holders, and revokes one person’s, or every live one, with a reason and an audit event. The reference has the routes.
This capability never issues a long-lived credential. Cloudflare answers a create with a day-long write token, and the create route revokes it before it answers. The long-lived credential is your app’s own, and you already revoke that in auth.
What it deliberately does not do
It does not decide what your roles mean. A grant is read or write, and you write it. The organization power that manages repositories is one you name.
It does not fork or import. The binding offers both, and neither is needed to hand somebody a repository.
It does not meter storage. A repository is capped at 1 GB and an account at 1 TB. The capability reports what Cloudflare holds, and what to do about a large repository is your decision.
Workers Paid only
Artifacts runs on the Workers Paid plan and nowhere else. On a Free plan the Worker deploys and the first create is refused, at runtime, in production. Cloudflare bills it from 14 October 2026: $0.15 per 1,000 operations past 10,000 a month, and $0.50 per GB-month past 1 GB. Plan, prices and limits maps each route onto those meters.
When you would reach for it
When your customers need a real git repository, and you would rather not run one. A content product that versions documents. A tool that hands each team its own repository of configuration. An app that keeps its own history in git and never shows anybody a clone URL.
Not for your own source code. That is what your own git host is for.
What it needs
It requires nothing. auth is optional and effectively required: a repository belongs to a signed-in person, so without auth every route denies. organization is optional, and lets an organization own repositories. audit is optional, and records every create, delete, grant change, mint and revoke, never the token.
pithy add artifacts writes the config and the bindings and touches no account. There is nothing to provision. Cloudflare creates a namespace on its first repository.