Skip to content

What lives where

Which part of the setup sits on your computer, which sits on your Claude account, which sits on GitHub, and where to go to take access away.

Sign in to Claude on a second computer, or on the phone app, and the Documentation repository is already waiting in the selector. You didn't repeat Step 4, and nothing was copied off the first machine. The connection between Claude and GitHub belongs to your Claude account, not to the computer you set it up on, so it is there on every device you sign in from.

That is convenient, and it changes where you look to check the setup and where you go to take access away. Deleting Claude off a laptop revokes nothing.

Three places, not one

ON YOUR DESK This computer The desktop app Your Claude sign-in Local settings and MCP servers Local session history Your own git credentials Nothing here grants access to the repository. ANTHROPIC'S CLOUD Your Claude account Your seat The link to your GitHub account Your cloud environments Every cloud session and its diff This is the part that follows you from device to device. GITHUB The repository's home The files and their whole history Your membership and Write access The Claude GitHub App installation Every branch and pull request This is what decides which repositories a session can reach. ON ANOTHER DEVICE Set up again Already there Already there
The computer is the replaceable part. Access is held by the Claude account and by GitHub, and both of those follow you.

Item by item

What Where it lives On another device Where you change it
Your Claude seat Your claude.ai account Already there An Owner or Admin, under Organization settings → Members
The sign-in that proves the seat is yours This computer — the macOS Keychain where there is one, and a permission-protected file on Windows and Linux Sign in again Sign out from the account switcher in the app
The link between Claude and your GitHub account Your Claude account Already there, with no second authorization On GitHub, not on this computer — see Taking access away
The Claude GitHub App installation GitHub, on your account or on the organization Already there github.com/settings/installations
Your GitHub membership and Write access to Documentation GitHub Already there A GitHub organization Owner
Your cloud environments, including Default on Trusted network access Your Claude account Already there The environment pill at claude.ai/code
Cloud sessions, their conversations and their diffs Anthropic's servers, under your account All of them Archive or delete a session from the sidebar
Local sessions and their history This computer, under ~/.claude/ Not carried over Delete them from ~/.claude/; they are removed after 30 days anyway
Local settings, MCP servers and connectors This computer, in ~/.claude/settings.json and ~/.claude.json Not carried over Edit the files, or use /config in a local session
Your own git credentials and SSH keys This computer Not carried over Your operating system's keychain
The site's files GitHub, cloned fresh into every cloud session Cloned again Commit a change, the way Getting started describes

On Windows, ~/.claude is %USERPROFILE%\.claude.

Why one authorization covers every device

Step 4 authorizes the Claude GitHub App in a browser. There is one other way to make the link, used by developers who already have the GitHub command-line tool signed in: typing /web-setup in a Claude Code session reads the token gh holds on that machine and links it to your Claude account.

Both routes end in the same shape. Your Claude account learns how to reach GitHub as you, and the working credential is held on Anthropic's side rather than on your desk. That is why the second computer needs no authorization, and it is why the laptop can be wiped without changing what a session can do.

Four things follow.

One connection covers every device. A new laptop, a borrowed machine, the browser at claude.ai/code, the phone app: signing in is the only step. If you expected to re-authorize GitHub and were not asked to, nothing has gone wrong.

Clearing your computer takes nothing away. Uninstalling the desktop app, deleting ~/.claude or handing the laptop back leaves every session's reach exactly as it was. Access is held on your Claude account and on GitHub, and those are the two places to go.

A session reaches whatever your GitHub account reaches. Choosing Only select repositories in Step 4 governs which repositories Claude receives GitHub events for, not which ones it can open. What limits a session is your access on GitHub itself, which is why Step 3 grants membership deliberately rather than broadly.

The work carries your name. Branches, commits and any reply Claude posts on a pull request are made with your GitHub identity. Replies are labeled as written by Claude Code, so a reviewer can tell, but they appear under your username and the commit history names you.

Your GitHub token never enters the session

A cloud session runs on a machine in Anthropic's cloud, and that machine is not given your GitHub token. It holds a short-lived, narrowly scoped credential instead, which a proxy outside the machine translates into real GitHub authentication when a push or a clone actually happens.

The session's machine where Claude reads and edits holds a short-lived, scoped credential — and nothing more Anthropic's git proxy outside the session's machine translates that credential into your real GitHub authentication GitHub the clone comes from here and the branch is pushed back to it, under your GitHub identity Your own computer no part in this path: no files, no settings, no network • Your GitHub token never enters the session's machine. • A push is restricted to the branch that session is working on. • Every operation in the session is logged for audit. A local session is the opposite: it runs on your computer, with your files, your settings, your network and your own git credentials.
How a cloud session pushes a branch. The credential the session holds is exchanged for real GitHub authentication outside the machine.

What each kind of session can see

Step 5 compares cloud and local sessions for convenience. Here is the same pair compared for reach, which is the comparison that matters when someone asks what Claude had access to:

Cloud session Local session
The repository Cloned fresh from GitHub each time Your working copy on this machine
The rest of your disk Out of reach Readable, with your approval
Your settings, MCP servers and connectors Not used at all Used
Your own git credentials Not used — the proxy authenticates the push Used
The network Only what the environment allows: the common package registries, and little else Whatever your machine can reach
Where the conversation is kept Anthropic's servers, so it opens on any device This machine, and removed after 30 days

We use cloud sessions for documentation work, so the second column is the exception rather than the rule. It comes up when a batch of source documents is already sitting in a folder on your machine, which is the case Step 8 covers.

Taking access away

Access is held in two systems, Claude and GitHub, so closing one door leaves the other open. This is the table to work from when a laptop goes missing, a contractor finishes, or someone leaves the firm.

To stop this Do this What it leaves in place
One person's sessions reaching this repository Remove their Write access, or their organization membership, at github.com/orgs/Leahy-Consulting/people Their Claude seat, and any other repository their personal GitHub account can see
The Claude GitHub App acting on your GitHub account Revoke it at github.com/settings/installations A connection made with /web-setup, which rides on the GitHub command-line tool's own authorization
A connection made with /web-setup Revoke the GitHub CLI authorization under Settings → Applications, then run gh auth logout on that machine The Claude GitHub App installation
The App reaching the organization's repositories at all An Owner removes the approval at Third-party access → GitHub Apps Personal repositories, and other members' own authorizations
One person's Claude sessions entirely An Owner or Admin removes the seat under Organization settings → Members Their GitHub access, which a GitHub Owner has to remove separately
Cloud sessions for the whole organization An Owner turns them off at claude.ai/admin-settings/claude-code Local sessions, and GitHub access held by individual accounts

Deleting the app off a laptop is not revocation

A wiped machine, an uninstalled desktop app and a deleted ~/.claude folder all leave the Claude account and the GitHub authorization untouched. Someone who can sign in to that Claude account still reaches every repository the linked GitHub account reaches. Revoke on GitHub and remove the seat on claude.ai; those two are the whole job.

Sharing a session shares what it read

A cloud session can be shared with the rest of the claude.ai organization, and the transcript carries whatever the session touched: file contents, command output and anything printed along the way. Read it before you share it. The default for a Team account is Private, the alternative is Team, and recipients are checked for access to the repository before they can open it. Both settings are under Settings → Claude Code → Sharing settings.

The session that wrote the getting-started page is an example of a session shared deliberately. Sign in with your Leahy Consulting account to open it.

Checks worth knowing how to make

Question Where the answer is
Which GitHub account is Claude connected as? The repository selector at claude.ai/code lists what that account can see. github.com/settings/installations names the accounts the App is installed on
Where is the Claude GitHub App installed, and on which repositories? github.com/settings/installations for you, and Third-party access for the organization
Which environment will my next session use? The environment pill under the prompt box, which should read Cloud — Default
What is on this computer? ~/.claude/, or %USERPROFILE%\.claude on Windows
Who has a Claude seat, and what has it used? Organization settings → Members, and the Claude Code analytics dashboard

Habits worth keeping

  • Sign out of Claude on any machine that isn't yours. The sign-in is the one part of this that lives on the machine, so it is the one part that leaves with it.
  • Treat a lost laptop as a Claude sign-in to revoke and a GitHub authorization to review, not as a lost set of repository keys. The keys were never on it.
  • When someone leaves, close both doors. Removing the seat stops new sessions; removing GitHub access is what closes the repository.
  • Read a session before you share it.

Anthropic documents its side of this in Claude Code on the web, Security and Data usage. The rest of the setup is in Getting started with Claude Code, the reasoning behind GitHub, Claude and Cloudflare is in How this site works, and Where to start routes you to whichever of them you need.

Support & contact

Our team is glad to walk through any of this: a revocation you want checked, a laptop that has gone missing, or a seat that needs moving.