Selling access to a GitHub repo
Sell source code, templates or a private library. Paying customers are invited to a private GitHub repository automatically, and removed after a full refund.
This is optional, and off until you set two environment variables. It's how Launchfast itself is delivered.
How it works for your customer
- They pay for any plan.
- If they signed in with GitHub, they're invited to the repository as soon as the payment is confirmed.
- Otherwise, the dashboard shows Connect GitHub. Linking their GitHub account sends the invite. It can be a different GitHub account from the email they signed in with.
- Or they click Or enter a GitHub username and type it.
- GitHub emails them an invitation with read access.
One purchase covers one GitHub account. Switching to another username (for example, to fix a typo) removes the account invited before, so one purchase can't invite several people.
When a customer no longer has any paid plan (after a full refund, or when a subscription ends), they're removed from the repository, and a pending invitation is cancelled.
Set it up
Create the repository
A private repository holding what you sell, such as your-org/your-product. Using a GitHub organization keeps it separate from your personal account.
Create a fine-grained token
- Open github.com/settings/personal-access-tokens/new.
- Resource owner: the account or organization that owns the repository. For an organization, it may need to approve the token under Settings → Personal access tokens.
- Expiration: pick the longest allowed, and set a reminder to renew it.
- Repository access: Only select repositories → your repository.
- Permissions → Repository permissions → Administration: Read and write. This lets the token add and remove collaborators. Metadata: Read-only is added automatically.
- Generate and copy the token.
Set the variables
GITHUB_REPO=your-org/your-product
GITHUB_REPO_TOKEN=github_pat_…Add the same two in Vercel (setup copies them when it deploys) and redeploy.
Turn on GitHub sign-in (recommended)
With GitHub sign-in set up, buyers can connect their account in one click instead of typing a username.
When the token expires
Invites start failing with "GitHub didn't accept the invitation", and your Vercel logs show [repo-access] invite failed 401. Create a new token, update GITHUB_REPO_TOKEN in Vercel, and redeploy.
Collaborator limits
Private repositories on GitHub Free have no collaborator limit, but each outside collaborator in an organization may count toward your plan's seats on paid organization plans. Check your organization's billing settings.