To clone a Cloudflare Artifacts repo, a user or agent needs Git, its remote URL, and a valid repo token with read or write scope. Push requires write scope and a writable repo. A recipient using supplied Git credentials does not need their own Cloudflare account.
Artifacts Git credentials consist of the repository's remote URL and a token scoped to that repository. Read tokens permit clone, fetch, and pull. Write tokens also permit push.
For a supplied URL and read token:
git -c http.extraHeader="Authorization: Bearer $READ_TOKEN" clone "$REMOTE" workspace
To push an existing local commit to main with a supplied write token, run this from the local repository:
git -c http.extraHeader="Authorization: Bearer $WRITE_TOKEN" push "$REMOTE" HEAD:main
The remote should be the exact value returned by Artifacts. Tokens expire, so a workflow must obtain a fresh token when required. A repository configured as read-only cannot be pushed to.
Clone downloads a local copy. Fork creates another server-side repository and requires the management access described in the companion answer.
An application can create or fork the repository and issue credentials for its user or agent. From this credential model, it follows that the recipient does not need a personal Cloudflare account merely to use the supplied Git URL and token.
Sources: