> For the complete documentation index, see [llms.txt](https://mercure-technologies.gitbook.io/expo-open-ota/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mercure-technologies.gitbook.io/expo-open-ota/security/branch-protection.md).

# Branch protection

{% hint style="warning" %}
Branch protection is an Enterprise feature and requires [control-plane mode](/expo-open-ota/controle-plane-mode/overview.md). Marking a branch as protected, and granting a token access to protected branches, both require an active Enterprise license (see [Open core and licensing](/expo-open-ota/open-core-and-licensing.md))
{% endhint %}

Branch protection lets you mark a branch as critical so that only API tokens you explicitly trust can publish to it. It is the control you reach for when you want to keep production safe from tokens that were handed out for everyday work.

## Why protect a branch

When you create an API token, it can publish to every branch of the app by default, including the branch your production users receive updates from. That is fine for a token you keep to yourself, but not for one you hand to a teammate or paste into a CI pipeline.

A common setup: you let a developer or a CI job publish to a staging branch, but you never want that same token to reach production. With branch protection you mark `production` as protected, you leave the developer's token without protected-branch access, and the token keeps working on `staging` while the server blocks it on `production`.

## How it works

Branch protection is two independent switches:

* On a **branch**, an admin turns **Protected** on or off. A protected branch only accepts updates from tokens that are allowed on protected branches.
* On an **API token**, an admin decides whether the token **can act on protected branches**. This is off by default, so a freshly created token cannot touch a protected branch until you explicitly grant it.

When a token without that permission tries to [publish](/expo-open-ota/eoas/publish-an-update.md), [roll back](/expo-open-ota/eoas/rollback.md) or [republish](/expo-open-ota/eoas/republish.md) on a protected branch, the server rejects the request. Branches that are not protected are unaffected, and any token can still publish to them.

## Set it up

{% stepper %}
{% step %}

#### Protect the branch

In the dashboard, open **Branches & updates**, find the critical branch and switch it to **Protected**. You are asked to confirm, because from that point on tokens without protected-branch access can no longer publish to it.
{% endstep %}

{% step %}

#### Allow the tokens that need it

Open **API tokens**, edit the restrictions of the tokens that are meant to reach protected branches (for example your release pipeline token), and enable **can act on protected branches**. Leave every other token as it is.
{% endstep %}
{% endstepper %}

## See also

[IP whitelisting](/expo-open-ota/security/ip-whitelisting.md) restricts the source addresses a token can be used from.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://mercure-technologies.gitbook.io/expo-open-ota/security/branch-protection.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.