GitHub authentication — quick notes

| Mechanism | Reach / owner | Lifetime / prerequisite | |---|---|---|---| | GITHUB_TOKEN | Workflow repository; unique per job | Job end or effective maximum lifetime | | GitHub App | Installed target repositories; App identity | One-hour installation token; App private key required | | PAT | Selected user-authorized reach; a person | Expiration/policy; loses access with that user |

• Declare only required workflow/job permissions:; omitted named permissions become none.
• For cross-repository App automation, install the App on the target repositories.
• Where supported, make PATs fine-grained by owner, repositories, permissions, and expiration.

Decision: built-in token within its repository; App installation for cross-repository automation; user-bound PAT fallback where supported.

Sources: https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-400 · https://docs.github.com/en/actions/concepts/security/github_token · https://docs.github.com/en/actions/tutorials/authenticate-with-github_token · https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax · https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/making-authenticated-api-requests-with-a-github-app-in-a-github-actions-workflow · https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/about-authentication-with-a-github-app · https://docs.github.com/en/rest/apps/apps?apiVersion=2026-03-10 · https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens · https://docs.github.com/en/authentication/connecting-to-github-with-ssh/managing-deploy-keys