Signal / 031 — GitHub Apps get narrower keys for repository automation

Fresh signal: Automation often asks for administrator access because the platform never offered a smaller key. GitHub has split two common jobs away from that oversized permission.

GitHub announced on October 13 that GitHub Apps and fine-grained personal access tokens have new repository permissions. repository_creation:write can create repositories without the broader repository_administration:write permission, which also covers sensitive actions such as deletion and transfer.

Smaller blast radius

A second permission, installation_repositories:write, lets approved automation add or remove a repository from an app installation. GitHub says this enables organizations to manage which apps can access which repositories without relying on an administrator’s classic token with the coarse repo scope.

Repository administrators can also add an already organization-approved app to their repositories without asking the organization owner again. Owners can still restrict installation changes. GitHub Apps now support offline_access for gradual migration back to short-lived user tokens, and a dedicated Credentials tab separates client secrets and key pairs from general app settings.

Least privilege needs maintenance

Opinion: Smaller permissions only reduce risk when teams actually remove the old broad grants. Inventory classic PATs, document which job owns each credential, migrate one workflow at a time, and confirm that revoking the original token does not break a forgotten deployment path.

GitHub says most improvements are coming to GitHub Enterprise Server 3.24; offline_access support is planned for 3.23. Cloud availability is announced now, but administrators should verify their own account and policy controls before migration.

AI-assisted summary: Drafted with AI assistance and reviewed against GitHub’s official October 13 changelog. Availability details are reported, not independently tested.