How to Create and Manage Personal Access Tokens in GitHub

Readers will learn how to create and manage personal access tokens on GitHub. GitHub provides these official steps for authentication.

What it does

GitHub states that you can use a personal access token in place of a password when authenticating to GitHub in the command line or with the API.

Before you start

GitHub recommends that you use fine-grained personal access tokens instead of personal access tokens (classic) whenever possible. Before creating a token, verify your email address if it has not been verified yet.

Steps

Step 1: GitHub says you can create a fine-grained token by clicking your profile picture in the upper-right corner of any page on GitHub, then clicking Settings. In the left sidebar, click Developer settings, then click Fine-grained tokens under Personal access tokens, and click Generate new token.

Step 2: Under Token name, enter a name for the token, select an expiration, and optionally add a description. Under Resource owner, select a resource owner, select which repositories you want the token to access under Repository access, select which permissions to grant the token under Permissions, and click Generate token.

Step 3: Alternatively, to create a classic token, GitHub says you can click Settings, Developer settings, and Tokens (classic) under Personal access tokens. Select Generate new token, then click Generate new token (classic).

Step 4: In the Note field, give your token a descriptive name, select Expiration to choose a default option or click Custom to enter a date, select the scopes you would like to grant, and click Generate token.

What the company says

GitHub states that personal access tokens are intended to access GitHub resources on behalf of yourself. GitHub also notes that it automatically removes personal access tokens that haven't been used in a year as a security precaution.

What to do

• Verify your email address if it hasn't been verified yet.
• Choose the minimal repository access and minimal permissions necessary for your needs.
• Delete a personal access token if it is no longer needed.