Personal access tokens
/settings/tokens lists and issues tokens for the API, git over HTTPS and
automation. Tokens start with gct_; the list only ever shows the last eight
characters.
View your tokens
Each token shows its name, last eight characters, expiry, and a one-line
summary of its permissions: a single grant reads in plain words, for example
Read & write code on all repositories; several list each resource under its
highest level, for example Admin: repositories · Read: issues. Show
permissions expands a table with one row per resource and target and the
families granted at each level. Revoked tokens are badged Revoked and keep
their history. Click a token's name to open its detail: creation, expiry and
revocation dates, the actor it acts as, who delegated it (if anyone) and the
permission table. Long lists page with Load more.
Create a token
Generate new token opens a form:
- Name: a label for your own reference.
- Expiration: 30, 60 or 90 days, or 1 year. Every token expires.
- Permissions: one or more grants. Each grant picks a Target
(Repositories, Branches, Pull requests, Issues, Comments, Organizations,
Teams, Tokens & keys, Personal profile), a Scope (everything of that kind; branches and pull
requests can instead be narrowed to a branch pattern such as
release/*), and a level per permission family: No access, Read, Read & write or Admin, limited to what that family allows. A preview under each grant reads back exactly what it will allow. Add another grant stacks more; the bin removes one.
The secret is shown once, in a Token created dialog with a copy button. Close it and the secret is gone; issue or rotate to get a new one.
Rotate or revoke a token
Rotate issues a replacement secret with the same name, permissions and expiry, revokes the old one, and shows the new secret once. Revoke ends the token immediately. Neither can be undone.
Confirmation
Issuing, rotating and revoking need a recent confirmation of your identity. If your session's confirmation window has lapsed a Confirm it's you dialog appears; confirm with a passkey or password and the action completes on its own. See account settings.