Unable to create a Personal Access Token via API

[AkshayYeti]

Select Topic Area

General

Body

Hi Everyone,

I am currently working on a project that requires regular rotation of GitHub Personal Access Tokens, with the goal of creating a new token and deleting the old one every month. While developing this solution, I couldn’t find any documentation or API endpoints in GitHub’s resources that support creating Personal Access Tokens programmatically.

Can you please confirm whether this functionality is still supported? If not, is there a better/recommended approach for automating token rotation within GitHub?

Note: I am aiming for the Token (Classic) version to be created and deleted via REST API endpoint in python.

Thank you for your assistance!

Thank you
Akshay

[rajtilak-2020]

Automating GitHub Personal Access Token Rotation

Hi Akshay,

GitHub currently does not support programmatic creation or deletion of Personal Access Tokens (PATs), including the classic tokens, via their REST or GraphQL APIs. Personal Access Tokens must be created manually through the GitHub settings page.

---

Recommended Approaches for Automating Token Rotation

1. Use GitHub Apps for Automation:

   • Instead of relying on PATs, consider using GitHub Apps. These are designed for programmatic access and can generate installation access tokens dynamically via API.
   • Access tokens for GitHub Apps are time-limited and can be refreshed as needed.
   • Refer to the GitHub Apps documentation for more details.

2. Self-Managed Token Rotation:

   • If you must use PATs, you can create a semi-automated workflow to assist with rotation:
     • Schedule reminders for manual token creation.
     • Write scripts to update configuration files or secrets in your CI/CD pipelines with the new token.

3. Secrets Management Tools:

   • Use a secrets management tool (e.g., HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault) to securely store and manage PATs.
   • These tools can help automate the distribution and revocation of tokens without direct API support from GitHub.

---

Alternatives to Classic Tokens:

GitHub is encouraging the use of fine-grained Personal Access Tokens, which offer better security controls and will eventually replace classic tokens. While these still cannot be created programmatically, they may better suit your use case.

---

Next Steps:

• Consider whether GitHub Apps or fine-grained tokens fit your requirements.
• For further confirmation or updates on API capabilities, you can follow GitHub's API documentation or reach out to GitHub Support.

I hope this helps! Let me know if you need further clarification.

Best regards,
K Rajtilak

[AkshayYeti]

Thank you @rajtilak-2020 , that helped