Expired Git provider token in Gitpod: does it block only Git operations or also new workspace and prebuild starts?

I am designing a least-privilege authentication setup for Gitpod workspaces backed by a Git provider OAuth integration (GitHub, GitLab, or Bitbucket). I understand that each workspace receives a short-lived, per-workspace Git credential, and that if the stored provider token expires or is revoked, Git operations such as fetch and push inside a running workspace fail until the user re-authenticates.

What is unclear to me is the blast radius of an expired or revoked provider token beyond in-workspace Git commands. Specifically, I cannot find a definitive statement on whether an expired token also prevents creating new workspaces or triggering prebuilds for repositories from that provider, or whether those flows fail independently with a different error path. I also want to confirm whether this behavior is consistent across providers, or whether GitHub, GitLab, and Bitbucket differ because of their distinct OAuth scope and token models.

My questions:

• Does an expired provider token block new workspace creation and prebuilds, or only Git operations inside existing workspaces?
• Is the re-authentication flow identical across GitHub, GitLab, and Bitbucket, or provider-specific?
• Does the answer differ between Gitpod's hosted offering and a self-managed/Enterprise deployment where the OAuth app is registered by an admin?

Version and deployment type are open; I would like guidance that notes where behavior is version-sensitive.