The News, Explained
GitHub announced on October 13, 2026 a set of permission, token and management changes for GitHub Apps and fine-grained personal access tokens, or PATs. A PAT is a credential that replaces a password for API access and automation. The common goal is least privilege: an app should receive only the access required for its task. The changes narrow the permissions needed to create a repository or add one to an installation. Source
There are two new fine-grained repository permissions. repository_creation:write can create a repository in the granted account, while installation_repositories:write can add or remove a repository from a GitHub App installation in an organization. Both work with GitHub Apps and fine-grained PATs. Repository creation previously required repository_administration:write, which can also authorize deletion and transfer. The new permission grants creation alone. Installing an app in an organization still requires administrator approval. Source
The APIs for adding and removing repositories from an installation now support GitHub Apps and fine-grained PATs. They previously required the broad repo scope on a classic PAT. When a user token calls these APIs, the caller also has to be an organization owner or an administrator of that repository. GitHub therefore checks both the token permission and the person’s actual role. Source
A repository administrator can now add a repository they administer to an app that the organization has already approved and installed. A second organization-owner approval is not required. Organization owners can restrict this behavior, and their approval remains required for three sensitive permission sets: organization-level permissions, repository administration and repository creation. Source
GitHub Apps also support the OAuth offline_access scope. An authentication that requests it receives an expiring user access token and a refresh token, which can obtain a replacement after the shorter-lived access token expires. This lets an app move individual authentications to expiring tokens instead of changing every authorization at once. GitHub says the capability is available in GitHub Enterprise Server 3.23. Source
App management has expanded as well. A GitHub App can fetch details for private or internal apps when the ownership relationship qualifies, including apps in the same organization and certain internal apps within the same enterprise. A new Credentials tab groups client secrets and key pairs. GitHub says most changes in this release, apart from offline_access, are available in GitHub Enterprise Server 3.24. Source
OYOPICK’s Take
The risk of an automation credential grows with its permission radius. Letting a repository-creation bot operate without deletion or transfer access can directly reduce the damage from a mistake or token leak. The benefit depends on app developers updating their registrations instead of continuing to request the older broad permission.
Allowing repository administrators to connect an already-approved app can reduce repeated work for organization owners. Organizations still need a clear audit trail and alerts showing which app was added to which repository. Operational quality will depend on preserving visibility after an approval step is removed.
A staged path to expiring tokens is a practical way to reduce long-lived credentials. Teams can begin with lower-risk authentications, measure refresh failures and recovery, and expand after the flow is reliable. Showing token type, last use and rotation state in the Credentials view would make permission scope and credential lifetime easier to assess together.