Personal access tokens
/settings/tokens lists and issues tokens for the API, git over HTTPS and
automation. Tokens start with gct_; the list only ever shows the last eight
characters.
View your tokens
Each token shows its name, last eight characters, expiry, and the permissions
it carries in plain words, one line per grant, for example
Read & write code on all repositories. Revoked tokens are badged
Revoked and keep their history. Click a token to open its detail: creation,
expiry and revocation dates, the actor it acts as, who delegated it (if anyone)
and the full permission list. Long lists page with Load more.
Create a token
Generate new token opens a form:
- Name: a label for your own reference.
- Expiration: 30, 60 or 90 days, or 1 year. Every token expires.
- Permissions: one or more grants. Each grant picks a Target
(Repositories, Branches, Pull requests, Issues, Comments, Organizations,
Teams, Tokens, Personal profile), a Scope (everything of that kind; branches and pull
requests can instead be narrowed to a branch pattern such as
release/*), and a level per permission family: No access, Read, Read & write or Full admin, limited to what that family allows. A preview under each grant reads back exactly what it will allow. Add another grant stacks more; the bin removes one.
The secret is shown once, in a Token created dialog with a copy button. Close it and the secret is gone; issue or rotate to get a new one.
Rotate or revoke a token
Rotate issues a replacement secret with the same name, permissions and expiry, revokes the old one, and shows the new secret once. Revoke ends the token immediately. Neither can be undone.
Confirmation
Issuing, rotating and revoking need a recent confirmation of your identity. If your session's confirmation window has lapsed a Confirm it's you dialog appears; confirm with a passkey or password and the action completes on its own. See account settings.