How do style updates from non-public web sources work?

[spaghetti-guy]

Hi,

I did some searching on this repository, but I wasn't able to find any information on how Stylus accesses non-public files. Specifically, I have a private GitHub repository with a style like [name].user.css. To install the style, I click the "Raw" button on the script's page then click the install button in the Stylus editor page that opens. When installing in this way, I noticed the update URL has a ?token=[token text] at the end.

Out of curiosity, I tried opening the update URL in a fresh incognito/private window in a different browser. To my surprise, the script was accessible. It was even accessible when opening the URL on a completely different device. For a short while after installation of the script, I can click the "Check for updates" button and will be told there are no updates available. However, it seems the update URL expires after a few minutes as eventually it stops working and provides a 404 error in Stylus (and also when accessing the URL on other browsers/devices).

Where does this token come from? How long does it last? Is it specific to scripts hosted on GitHub or does it work for scripts on any non-public web host? I'm really just curious as to how it works. I apologize if this is answered elsewhere, I searched issues and discussions but wasn't able to find any documentation.

[tophf]

Stylus doesn't add any token to the installation URL, it uses the URL exactly as provided by the page.

[spaghetti-guy]

I see, so this is standard GitHub behavior. Hovering over the "Raw" button did not show the token nor did right-clicking it and choosing "open in new private window". However, disabling Stylus and clicking the "Raw" button does indeed modify the URL and add the token. Sorry about that, I didn't think to test with Stylus disabled. Thanks for your response.