komrad forge connect

With --method token, the default, the token is read from standard input, or from the file --token-file names. It is never taken as an argument, since arguments are visible to every process on the machine. Pipe it in:

gh auth token | komrad forge connect github.com
op read op://vault/github/token | komrad forge connect github.com

With --method github-app nothing is read. The service mints a token from the App named under [github_app] in its own config, checks the installation reaches at least one repository, and records the App's own name as the login. That is the engine's path, where nobody is there to paste a token and the App's key is already on the machine: komrad forge connect github.com --method github-app --engine remote.

The service asks the forge who the credential belongs to before storing anything, so a token that is wrong or expired is refused here rather than found out later. That proves the token is real, not that it can read your repositories: a token with no permissions answers the same question, and shows up later as a repository the forge says it cannot find. github.com and gitlab.com say which forge they run; any other host needs --kind, and --api-url when the API is not at https://<host>/api/v3 for GitHub or /api/v4 for GitLab. The address has to be https.