Git asks ink auth git-credential for the token on each request, so it is never written into Git's configuration. Without the Ink CLI, sh -c "$(curl -fsSL 'https://git.laellabs.com/services/public/install.sh')" installs a credential helper of its own. SSH uses the keys in your settings.
Get Git: install page. The sign-in steps use the Ink CLI, ink.
Sapling's Git mode fetches and pushes with git, so the same ink auth setup-git https://git.laellabs.com serves it and no token is written into Sapling's configuration. Push a commit to a branch with sl push --to <branch> (add --create for a new branch). Amend and rebase history stays in your clone: Git keeps no mutation records, so for shared amend history use a Sapling repository.