Tutorial: HTTPS push/pull with personal token
That's been on my mind for a while.
It's necessary for instances without password authentication (notably https://heptapod.host) and for users with two factor authentication (2FA)
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information