Weyoto GitGPT

Give your GPT access to real codebases.

Weyoto GitGPT is a Flask-based backend API that bridges GPT-powered AI tools (Custom GPTs) with third-party data sources like GitHub. It allows GPTs to read files, list repositories, and inspect commits from real codebases — securely, through authenticated API endpoints.

Currently in MVP stage with GitHub integration live. Figma and Google Drive integrations are planned.

---

API Endpoints

Status

Method	Endpoint	Description
GET	/	Health/status check. Returns version and available route prefixes.

Authentication

Authentication is passwordless — users verify via a 6-digit code sent to their email.

Method	Endpoint	Auth Required	Description
POST	/auth/request-code	No	Sends a 6-digit verification code to the provided email
POST	/auth/verify-code	No	Verifies the code and returns a permanent API key
GET	/auth/view-api-key	Yes	Returns the user's API key, GitHub connection status, and Pro status
POST	/auth/regenerate-api-key	Yes	Rotates the user's primary API key (requires a fresh verification code)

GitHub

All GitHub endpoints require a valid API key in the x-api-key header, plus a GitHub PAT saved via /github/set-pat.

Method	Endpoint	Auth Required	Description
POST	/github/query	Yes	Unified query endpoint. Use the action field to pick an operation.
POST	/github/set-pat	Yes	Saves a GitHub Personal Access Token for the authenticated user

Billing

Method	Endpoint	Auth Required	Description
POST	/billing/activate	Yes	Activates a Pro plan (monthly or annual) for the authenticated user

---

GitHub Query Actions

The /github/query endpoint uses an action field in the JSON body to determine what to do. Every request must include action, plus the parameters listed below.

Action	Required Params	Description
fetch_file	repo, path	Returns the raw content of a single file
list_files	repo	Returns a flat list of all file paths in a repository
get_latest_commit	repo	Returns the latest commit message, author, and timestamp
list_user_repos	(none)	Returns all repository full names accessible to the user's PAT

Example Request (fetch_file)

{
  "action": "fetch_file",
  "repo": "octocat/hello-world",
  "path": "README.md"
}

Example Response (fetch_file)

{
  "status": "ok",
  "action": "fetch_file",
  "repo": "octocat/hello-world",
  "path": "README.md",
  "content": "# Hello World\n..."
}

---

Authentication Flow

1. Request a code: POST /auth/request-code with { "email": "user@example.com" }
2. Check your inbox: A 6-digit code arrives via email (sent through Resend)
3. Verify the code: POST /auth/verify-code with { "email": "user@example.com", "code": "123456" }
4. Receive your API key: The response includes your permanent API key. Store it securely.
5. Use the API key: Pass it in the x-api-key header on every authenticated request.

Codes expire after 30 minutes. You can request a new code after a 60-second cooldown.

---

Rate Limits & Plans

Plan	Limit	Price
Free	20 requests per 6-hour window	Free
Pro	Unlimited	$1/month or $10/year

When a free user hits their limit, the API returns a 403 response with the time they can retry. The upgrade prompt is surfaced through the GPT's error message.

---

Tech Stack

Layer	Technology
Framework	Flask
ORM & Migrations	SQLAlchemy + Flask-Migrate
Database	PostgreSQL
Email	Resend
Hosting (dev/staging)	Render
Local tunneling	Cloudflare Tunnel
Auth	Passwordless email verification
GitHub API	Fine-grained PAT, read-only access

---

Project Structure

├── app.py                  # Flask app factory & entry point
├── config.py               # Configuration from environment variables
├── extensions.py           # SQLAlchemy & Migrate instances
├── middleware/
│   └── auth.py             # API key authentication decorator
├── models/
│   └── user.py             # User model (email, verification codes, plan info)
├── services/
│   └── email.py            # Resend email sending logic
├── utils/
│   ├── billing.py          # Usage tracking & limit helpers
│   └── limits.py           # Rate limit response formatting
├── modules/
│   ├── auth/
│   │   ├── routes.py           # Auth endpoints (request-code, verify-code, etc.)
│   │   └── github_oauth_routes.py  # Optional GitHub OAuth routes
│   ├── github/
│   │   ├── routes.py           # GitHub query & PAT endpoints
│   │   └── services.py         # GitHub API calls (fetch_file, list_repos, etc.)
│   ├── billing/
│   │   └── routes.py           # Plan activation endpoint
│   └── providers/
│       └── access.py           # Token storage & retrieval abstraction
└── gpt-awareness.md        # Developer notes & GPT behavior documentation

---

Setup & Local Development

Prerequisites

• Python 3.10+
• PostgreSQL (running locally or via a connection URL)
• A Resend account for sending emails

1. Clone the repository

git clone https://github.com/debaedoma/weyoto-gitgpt.git
cd weyoto-gitgpt

2. Create a virtual environment

python -m venv venv
source venv/bin/activate   # Linux/macOS
venv\Scripts\activate      # Windows

3. Install dependencies

pip install -r requirements.txt

4. Set environment variables

All configuration is read from system-level environment variables. Create the following:

Variable	Description
WEYOTO_GITGPT_DATABASE_URL	PostgreSQL connection string
WEYOTO_API_KEY_SECRET	Secret used for API key encryption
CORS_ORIGINS	Comma-separated list of allowed CORS origins
RESEND_API_KEY	Resend API key for sending emails
EMAIL_SENDER	Verified sender email in Resend
DEBUG	Set to true to enable debug mode
FERNET_SECRET_KEY	Key for Fernet encryption of stored tokens
GITHUB_CLIENT_ID	(optional) GitHub OAuth app client ID
GITHUB_CLIENT_SECRET	(optional) GitHub OAuth app client secret
GITHUB_REDIRECT_URI	(optional) OAuth redirect URI
FRONTEND_BASE_URL	(optional) Frontend callback URL for OAuth
ENABLE_GITHUB_OAUTH	(optional) Set to true to enable GitHub OAuth
FREE_PLAN_LIMIT	(optional) Max requests in the free plan window (default: 20)
FREE_PLAN_WINDOW_HOURS	(optional) Rolling window hours for free plan (default: 6)

5. Run database migrations

flask db upgrade

6. Start the server

flask run

The API will be available at http://127.0.0.1:5000.

Exposing locally (for GPT development)

Use Cloudflare Tunnel to expose your local API to the internet:

cloudflared tunnel --url http://localhost:5000

---

GitHub PAT Requirements

Users must create a fine-grained personal access token with the following minimum permissions:

Permission	Access	Purpose
Contents	Read-only	Reading repository files and trees
Commit statuses	Read-only	Fetching latest commit information
Metadata	Read-only	Accessing repository metadata (mandatory)

Tokens are validated on submission, used live for each request, and never stored in plain text on the server.

---

Deployment

The project is deployed on Render for dev/staging. Environment variables are configured in the Render dashboard as system-level environment variables. No .env file is used in production.

---

Contact

Questions, feedback, or interest in using the tool?

📧 hello@weyoto.com or osadebaemma@gmail.com 🌐 gitgpt.weyoto.com