|
| 1 | +--- |
| 2 | +title: GitHub credential types reference |
| 3 | +shortTitle: Credential types reference |
| 4 | +intro: Reference documentation for all programmatic credential types that can access {% data variables.product.github %}, including token formats, lifespan, SSO authorization capabilities, and revocation options. |
| 5 | +allowTitleToDifferFromFilename: true |
| 6 | +versions: |
| 7 | + fpt: '*' |
| 8 | + ghes: '*' |
| 9 | + ghec: '*' |
| 10 | +contentType: reference |
| 11 | +--- |
| 12 | + |
| 13 | +This article provides a consolidated reference for all programmatic credential types that can access {% data variables.product.github %}. Use this reference to audit activity and manage credential revocation, especially during security incidents. |
| 14 | + |
| 15 | +## Credential types overview |
| 16 | + |
| 17 | +The following table lists all credential types that can programmatically access {% data variables.product.github %}. |
| 18 | + |
| 19 | +| Credential type | Credential prefix | Lifespan | Revocation | Associated with | |
| 20 | +|-----------------|-----------------|----------|------------|-----------------| |
| 21 | +| [{% data variables.product.pat_v1_caps %}](#personal-access-token-classic) | `ghp_` | Long-lived | Manual | User account | |
| 22 | +|[{% data variables.product.pat_v2_caps %}](#fine-grained-personal-access-token) | `github_pat_` | Configurable (up to 1 year, or no expiration) | Manual | User account | |
| 23 | +| [{% data variables.product.prodname_oauth_app %} access token](#oauth-app-access-tokens) | `gho_` | Long-lived | Manual | User account | |
| 24 | +| [{% data variables.product.prodname_github_app %} user access token](#github-app-user-access-tokens) | `ghu_` | Short-lived (8 hours) | Automatic expiry or manual | User account | |
| 25 | +| [{% data variables.product.prodname_github_app %} installation access token](#github-app-installation-access-tokens) | `ghs_` | Short-lived (1 hour) | Automatic expiry | App installation | |
| 26 | +| [{% data variables.product.prodname_github_app %} refresh token](#github-app-refresh-tokens) | `ghr_` | Long-lived (6 months) | Manual | User account | |
| 27 | +| [User SSH key](#user-ssh-keys) | Not applicable | Long-lived | Manual | User account | |
| 28 | +| [Deploy key](#deploy-keys) | Not applicable | Long-lived | Manual | Repository | |
| 29 | +| [`GITHUB_TOKEN`](#github_token-github-actions) ({% data variables.product.prodname_actions %}) | Not applicable | Short-lived (job duration) | Automatic expiry | Workflow run | |
| 30 | + |
| 31 | +## Credential revocation |
| 32 | + |
| 33 | +The following sections describe revocation options for each credential type based on your role. See also [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/token-expiration-and-revocation). |
| 34 | + |
| 35 | +> [!NOTE] Enterprise owners have options for **bulk actions** in major incidents. See [Bulk actions for security incidents](#bulk-actions-for-security-incidents). |
| 36 | +
|
| 37 | +### {% data variables.product.pat_v1_caps %} |
| 38 | + |
| 39 | +* If the token **belongs to you**, you can delete it via your personal account settings. See [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#deleting-a-personal-access-token). |
| 40 | +{% data reusables.credentials.revoke-via-api %} |
| 41 | +* **Organization owners** and **enterprise owners** do not have direct visibility into or control over individual tokens. However, they can:{% ifversion fpt or ghec or ghes > 3.17 %} |
| 42 | + * Revoke them using the REST API, if the actual token value is known. See [AUTOTITLE](/rest/credentials/revoke?apiVersion=2022-11-28#revoke-a-list-of-credentials).{% endif %} |
| 43 | + * Restrict the access of {% data variables.product.pat_generic_plural %} to the organization or enterprise entirely. See [AUTOTITLE](/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization) and [AUTOTITLE](/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-personal-access-tokens-in-your-enterprise). |
| 44 | +* **Organization owners and enterprise owners** on {% data variables.product.prodname_ghe_cloud %} with SSO enforced can revoke the SSO authorization for a specific {% data variables.product.pat_v1 %}. See [Revoking SSO authorization](#revoking-sso-authorization) for details. |
| 45 | +* **Revoked automatically** if pushed to a public repository or gist, or if unused for one year. See [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/token-expiration-and-revocation). |
| 46 | + |
| 47 | +### {% data variables.product.pat_v2_caps %} |
| 48 | + |
| 49 | +* If the token **belongs to you**, you can delete it via your personal account settings. See [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#deleting-a-personal-access-token). |
| 50 | +{% data reusables.credentials.revoke-via-api %} |
| 51 | +* **Organization owners**: Can view and revoke individual tokens. Note, however, that when an organization owner revokes a {% data variables.product.pat_v2 %}, any SSH keys created by the token will continue to work and the token will still be able to read public resources within the organization. The revocation changes the resource owner from the organization to the user, and the user can reassign it back. See [AUTOTITLE](/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization). |
| 52 | +* **Organization owners** and **enterprise owners** can:{% ifversion fpt or ghec or ghes > 3.17 %} |
| 53 | + * Revoke the token using the REST API. See [AUTOTITLE](/rest/credentials/revoke?apiVersion=2022-11-28#revoke-a-list-of-credentials).{% endif %} |
| 54 | + * Restrict the access of {% data variables.product.pat_generic_plural %} to the organization or enterprise entirely. See [AUTOTITLE](/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization) and [AUTOTITLE](/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-personal-access-tokens-in-your-enterprise). |
| 55 | +* **Revoked automatically** if pushed to a public repository or gist, or if unused for one year. See [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/token-expiration-and-revocation). |
| 56 | + |
| 57 | +### {% data variables.product.prodname_oauth_app %} access tokens |
| 58 | + |
| 59 | +* **Users** can revoke their authorization to an {% data variables.product.prodname_oauth_app %} in their personal account settings, which will revoke any tokens associated with the app. See [AUTOTITLE](/apps/oauth-apps/using-oauth-apps/reviewing-your-authorized-oauth-apps). |
| 60 | +{% data reusables.credentials.revoke-via-api %} |
| 61 | +* **Organization owners** can deny a previously approved {% data variables.product.prodname_oauth_app %}'s access to the organization. See [AUTOTITLE](/enterprise-cloud@latest/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization). |
| 62 | +* Enterprise and organization owners cannot directly revoke SSO authorization for individual {% data variables.product.prodname_oauth_app %} tokens. |
| 63 | +* **Revoked automatically** if pushed to a public repository or gist, or if unused for one year. See [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/token-expiration-and-revocation). |
| 64 | + |
| 65 | +### {% data variables.product.prodname_github_app %} user access tokens |
| 66 | + |
| 67 | +* **Users** can revoke their authorization to an {% data variables.product.prodname_github_app %} in their personal account settings. Note that this revokes authorization for **all** organizations, not just a specific one. See [AUTOTITLE](/apps/using-github-apps/reviewing-and-revoking-authorization-of-github-apps). |
| 68 | +{% data reusables.credentials.revoke-via-api %} |
| 69 | +* **Organization owners** can't revoke user authorizations directly, but can suspend or uninstall the app to prevent access to organization resources. See [AUTOTITLE](/apps/using-github-apps/reviewing-and-modifying-installed-github-apps). |
| 70 | +* Enterprise and organization owners cannot directly revoke SSO authorization for individual {% data variables.product.prodname_github_app %} user access tokens. |
| 71 | +* **Automatically expires** after 8 hours by default. See [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/token-expiration-and-revocation#user-token-expired-due-to-github-app-configuration). |
| 72 | + |
| 73 | +### {% data variables.product.prodname_github_app %} refresh tokens |
| 74 | + |
| 75 | +* **Users** can revoke the {% data variables.product.prodname_github_app %} authorization, which also invalidates associated refresh tokens. See [AUTOTITLE](/apps/using-github-apps/reviewing-and-revoking-authorization-of-github-apps). |
| 76 | +{% data reusables.credentials.revoke-via-api %} |
| 77 | +* **Automatically expires** after 6 months. |
| 78 | + |
| 79 | +### {% data variables.product.prodname_github_app %} installation access tokens |
| 80 | + |
| 81 | +* **App owners** can revoke via `DELETE /installation/token`. See [AUTOTITLE](/rest/apps/installations?apiVersion=2022-11-28#revoke-an-installation-access-token). |
| 82 | +* **Organization owners and enterprise owners**: Can uninstall the app from the organization, which deactivates all associated installation tokens. See [AUTOTITLE](/apps/using-github-apps/reviewing-and-modifying-installed-github-apps). |
| 83 | +* **Automatically expires** after 1 hour. |
| 84 | + |
| 85 | +### User SSH keys |
| 86 | + |
| 87 | +* **Users** can delete the credential via **Settings > SSH and GPG keys**. See [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys). |
| 88 | +* **Organization owners and enterprise owners** on {% data variables.product.prodname_ghe_cloud %} with SSO enforced can revoke the SSO authorization for a specific SSH key. Once revoked, the same key cannot be re-authorized—the user must create a new SSH key. See [Revoking SSO authorization](#revoking-sso-authorization) for details. |
| 89 | +* **Automatically deleted** if unused for one year. See [AUTOTITLE](/enterprise-cloud@latest/authentication/troubleshooting-ssh/deleted-or-missing-ssh-keys). |
| 90 | + |
| 91 | +For more information on SSH keys, see [AUTOTITLE](/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account). |
| 92 | + |
| 93 | +### Deploy keys |
| 94 | + |
| 95 | +* **Repository admins** can delete keys via **Repository settings > Security > Deploy keys**. Also available via the Deploy keys REST API. See [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/reviewing-your-deploy-keys).{% ifversion fpt or ghec or ghes > 3.15 %} |
| 96 | +* **Organization owners** can disable deploy keys entirely across the organization, which disables all existing deploy keys. See [AUTOTITLE](/organizations/managing-organization-settings/restricting-deploy-keys-in-your-organization).{% endif %} |
| 97 | +* **Enterprise owners** can enforce a policy to disable deploy keys across all repositories. See [AUTOTITLE](/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise). |
| 98 | + |
| 99 | +For more information on deploy keys, see [AUTOTITLE](/authentication/connecting-to-github-with-ssh/managing-deploy-keys). |
| 100 | + |
| 101 | +### `GITHUB_TOKEN` ({% data variables.product.prodname_actions %}) |
| 102 | + |
| 103 | +* **Automatically expires**: The `GITHUB_TOKEN` is created at the start of each workflow job and expires when the job completes. There is no manual revocation mechanism. During an incident, you can disable {% data variables.product.prodname_actions %} on the repository to prevent new tokens from being issued. |
| 104 | + |
| 105 | +For more information on `GITHUB_TOKEN`, see [AUTOTITLE](/actions/concepts/security/github_token). |
| 106 | + |
| 107 | +## SSO authorization |
| 108 | + |
| 109 | +When single sign-on (SSO) is required at the enterprise level, enforced at the organization level, or enabled for an organization and a member has linked an identity, certain credential types must be authorized for an organization before they can access organization resources. The following table indicates which credential types can be authorized for an organization. |
| 110 | + |
| 111 | +| Token type | Supports SSO authorization | Admins can revoke SSO authorization | |
| 112 | +|-----------------|---------------------------|-------------------------------------| |
| 113 | +| {% data variables.product.pat_v1_caps %} | {% octicon "check" aria-label="Yes" %} | {% octicon "check" aria-label="Yes" %} | |
| 114 | +| {% data variables.product.pat_v2_caps %} | {% octicon "check" aria-label="Yes" %} | {% octicon "x" aria-label="No" %} | |
| 115 | +| {% data variables.product.prodname_oauth_app %} access token | {% octicon "check" aria-label="Yes" %}[^1] | {% octicon "x" aria-label="No" %} | |
| 116 | +| {% data variables.product.prodname_github_app %} user access token | {% octicon "check" aria-label="Yes" %}[^1] | {% octicon "x" aria-label="No" %} | |
| 117 | +| {% data variables.product.prodname_github_app %} installation access token | {% octicon "x" aria-label="No" %} (not required) | Not applicable | |
| 118 | +| {% data variables.product.prodname_github_app %} refresh token | {% octicon "x" aria-label="No" %} | Not applicable | |
| 119 | +| User SSH key | {% octicon "check" aria-label="Yes" %} | {% octicon "check" aria-label="Yes" %} | |
| 120 | +| Deploy key | {% octicon "x" aria-label="No" %} (repository-scoped) | Not applicable | |
| 121 | +| `GITHUB_TOKEN` ({% data variables.product.prodname_actions %}) | {% octicon "x" aria-label="No" %} (repository-scoped) | Not applicable | |
| 122 | + |
| 123 | +[^1]: SSO authorization is granted automatically when the user authorizes the app during an active SAML or OIDC session. These authorizations are not visible to users or admins in the {% data variables.product.github %} UI, and are not returned by the [List SAML SSO authorizations for an organization](/rest/orgs/orgs#list-saml-sso-authorizations-for-an-organization) REST API endpoint. |
| 124 | + |
| 125 | +For information on how to authorize a credential for SSO, see [AUTOTITLE](/enterprise-cloud@latest/authentication/authenticating-with-single-sign-on/authorizing-a-personal-access-token-for-use-with-single-sign-on), [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-fine-grained-personal-access-token), and [AUTOTITLE](/enterprise-cloud@latest/authentication/authenticating-with-single-sign-on/authorizing-an-ssh-key-for-use-with-single-sign-on). |
| 126 | + |
| 127 | +### Revoking SSO authorization |
| 128 | + |
| 129 | +On {% data variables.product.prodname_ghe_cloud %} with SSO enforced, when a credential supports SSO authorization, there are two independent containment options: |
| 130 | + |
| 131 | +* **Delete or revoke the credential itself**: Permanently removes all access associated with the credential. See the individual credential type sections above for who can perform this action. |
| 132 | +* **Revoke the credential's SSO authorization**: Blocks the credential from accessing a specific organization's resources without deleting it. Once revoked, the user cannot re-authorize the same credential; they must create a new one. |
| 133 | + |
| 134 | +Enterprise administrators and organization owners can revoke SSO authorization for the credential types marked in the table above: |
| 135 | + |
| 136 | +* **Organization owners** can manage SSO authorizations for organizations with organization-level SSO via the {% data variables.product.github %} UI. See [AUTOTITLE](/enterprise-cloud@latest/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization). |
| 137 | +* **Enterprise owners** can manage SSO authorizations for enterprises with enterprise-level SSO (including {% data variables.product.prodname_emus %}) via the {% data variables.product.github %} UI. See [AUTOTITLE](/enterprise-cloud@latest/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/viewing-and-managing-a-users-saml-access-to-your-enterprise#viewing-and-revoking-authorized-credentials). |
| 138 | + |
| 139 | +You can also manage SSO authorizations via the REST API. See [AUTOTITLE](/rest/orgs/orgs?apiVersion=2022-11-28#list-saml-sso-authorizations-for-an-organization). |
| 140 | + |
| 141 | +During a security incident, enterprise owners can revoke SSO authorizations in bulk. See [Bulk actions for security incidents](#bulk-actions-for-security-incidents). |
| 142 | + |
| 143 | +## Bulk actions for security incidents |
| 144 | + |
| 145 | +During a major security incident, there are some enterprise-level bulk actions that enterprise owners on {% data variables.product.prodname_ghe_cloud %} can take to respond quickly. These actions affect user SSH keys, {% data variables.product.prodname_oauth_app %} user access tokens, {% data variables.product.prodname_github_app %} user access tokens, {% data variables.product.pat_v1_plural %}, and {% data variables.product.pat_v2_plural %}. They do **not** affect {% data variables.product.prodname_github_app %} installation access tokens, deploy keys, or `GITHUB_TOKEN`. |
| 146 | + |
| 147 | +> [!WARNING] These are high-impact actions that should be reserved for major security incidents. They are likely to break automations, and it could take months of work to restore your original state. |
| 148 | +
|
| 149 | +* **Lock down SSO**: Temporarily block SSO for all users except enterprise owners, preventing access to SSO-protected resources. Available for {% data variables.product.prodname_emus %} or enterprises that use SSO. See [AUTOTITLE](/enterprise-cloud@latest/admin/managing-iam/respond-to-incidents/lock-down-sso). |
| 150 | +* **Revoke all SSO authorizations**: Remove SSO authorizations for user credentials across all organizations in the enterprise. Credentials are not deleted, but lose access to SSO-protected organization resources. Once revoked, credentials cannot be re-authorized—users must create new credentials. Available for {% data variables.product.prodname_emus %} or enterprises that use SSO. See [AUTOTITLE](/enterprise-cloud@latest/admin/managing-iam/respond-to-incidents/revoke-authorizations-or-tokens). |
| 151 | +* **Delete all user tokens and keys**: Delete user credentials entirely, removing all access. Available for {% data variables.product.prodname_emus %} **only**. See [AUTOTITLE](/enterprise-cloud@latest/admin/managing-iam/respond-to-incidents/revoke-authorizations-or-tokens). |
| 152 | + |
| 153 | +> [!NOTE] |
| 154 | +> For enterprises with personal accounts (non-EMU) that use SSO, the "delete all tokens and keys" option is **not available**. The "revoke SSO authorizations" action blocks access to SSO-protected organization resources, but does not block credentials from accessing enterprise-level endpoints or resources in organizations that do not enforce SSO. For enterprises without SSO, neither bulk action is available. |
0 commit comments