Summary

Personal Access Tokens, or PATs, provide users a quick way to create OAuth access tokens with they can use to make API calls. The tokens allow users to specify scopes to determine what the token can access. This is a typical way of getting API keys in other SaaS products. However, PATs only have broad scopes (e.g. repos or orgs), which grant access to anything the user can access (i.e. specific repos or orgs cannot be specified). This improvement will introduce a new version of PATs which provide users with the ability to scope access to specific repos and orgs, set fine-grained permissions across specific features, and set expiration dates for each token.

Intended Outcome

Allow users to create PATs with improved security and access controls.

How will it work?

Once introduced, GitHub will provide UI and tools for creating new PATS and migrating existing PATs to the new version. This new version of PATs will support the following:

• Scoping access to specific repos and orgs
• Fine-grained permissions across specific features
• Expiration dates for each token