Corigin

# docs

## overview

Corigin gives agents a Git remote for generated code.

## quickstart

### install the CLI

sh
npm install -g @corigin/cli

### sign in from the terminal

sh
corigin login

### create a repo

sh
corigin init hello-corigin
cd hello-corigin

### push with Git

sh
echo "hello from corigin" > README.md
git add README.md
git commit -m "initial commit"
git push -u origin main

## webhooks

Repo webhooks deliver accepted Corigin pushes to a public HTTPS endpoint.

### configure a webhook

Open a repo in the dashboard, then create a webhook from the Webhook section.

The URL must be a public HTTPS URL with a domain name. IP literals, localhost, and .localhost hosts are rejected.

Corigin returns the signing secret only when the webhook is created or replaced. Store it when it is shown.

### delivery

Corigin sends one push request after an accepted push creates a repo push event.

json
{
  "id": "77777777-7777-4777-8777-777777777777",
  "type": "push",
  "created_at": "2026-06-27T00:00:00.000Z",
  "repo_id": "33333333-3333-4333-8333-333333333333",
  "refs": [
    {
      "name": "refs/heads/main",
      "before": null,
      "after": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
      "force": false
    }
  ]
}

Requests include Corigin-Event-Id, Corigin-Event-Type, Corigin-Webhook-Timestamp, and Corigin-Webhook-Signature.

### verify the signature

The signature is HMAC SHA-256 over the timestamp, a period, and the raw request body.

ts
import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyCoriginWebhook(input: {
  body: Buffer;
  secret: string;
  signatureHeader: string;
  timestampHeader: string;
}) {
  const expected = createHmac("sha256", input.secret)
    .update(`${input.timestampHeader}.`)
    .update(input.body)
    .digest("hex");
  const received = input.signatureHeader.replace(/^v1=/, "");
  if (!/^[a-f0-9]{64}$/u.test(received)) return false;

  return timingSafeEqual(Buffer.from(expected, "hex"), Buffer.from(received, "hex"));
}

## GitHub sync

GitHub sync imports a GitHub repository into Corigin and keeps branch updates flowing into the Corigin remote.

### import from GitHub

Use Add GitHub sync in the dashboard. The setup flow installs or reuses the Corigin GitHub App, authorizes repository access, and returns to the dashboard with an import picker.

Choose one authorized repository. Corigin creates a repo, names it from the GitHub repository name, and stores the GitHub connection on the new Corigin repo.

### sync behavior

GitHub push webhooks for branch create and update events queue sync runs. Each connection syncs serially; independent connections can sync in parallel.

Branch deletes are ignored. If the GitHub App installation is removed, suspended, or loses access to a repository, Corigin disables the affected sync connection.

### disconnect

Open the Corigin repo, then use Disconnect in the GitHub section. Disconnecting removes the active sync connection for that Corigin repo; it does not delete the Corigin repo.

## [v1 api](https://api.corigin.dev)

### OpenAPI spec

source