How to Get a GitHub Personal Access Token

Key Takeaways

• Generate tokens from Settings > Developer settings > Personal access tokens.
• Fine-grained tokens restrict access to specific repositories and permissions.
• Pass the token to the REST API in the Authorization: Bearer header.
• Personal access tokens do not refresh automatically upon expiration.
• Treat API tokens like passwords and cache them locally for Git operations over HTTPS.

To get a GitHub personal access token, sign in to your account, click your profile picture, and go to Settings. Open Developer settings, select Personal access tokens, and choose Fine-grained tokens. Click Generate new token, configure your specific repository permissions, and copy the resulting string.

This token acts as a secure password replacement. It authenticates your scripts against the REST API. It also acts as your password when performing command-line Git operations over HTTPS.

Prerequisites

A few account settings must be in place before you generate a token. You need a GitHub account with a verified email address. GitHub Docs state, “Without a verified email address, you won’t be able to use all of GitHub’s features.” Spam prevention and security measures rely on this verification step.

You must decide your resource owner up front. A GitHub API token is scoped to either your personal account or a single organization. It cannot cover both environments at the same time.

If the token needs to read an organization’s private repositories, check the active organization policies. An organization administrator may need to approve fine-grained tokens before they function. Administrators might also need to allow classic access explicitly before your automated scripts can connect.

Step-by-step: creating a fine-grained personal access token

If you want to know how to get GitHub token credentials safely, follow the fine-grained token flow. This method restricts access to specific repositories rather than granting broad, account-wide access.

1. In the top-right corner of any GitHub page, click your profile photo.
2. Click Settings in the dropdown menu.
3. Select Developer settings from the bottom of the left sidebar.
4. Under Personal access tokens, select Fine-grained tokens.
5. Click Generate new token to begin the GitHub create access token process.
6. Type a descriptive token name and select an expiration date.
7. Pick the resource owner, which is either your personal account or an organization.
8. Under Repository access, choose Only select repositories and pick the exact projects you need.
9. Under Permissions, grant only the specific read or write permissions your REST endpoints require.
10. Click Generate token.

Copy the token value immediately. GitHub displays this string exactly once. You cannot retrieve it after leaving the page.

Expiration dates depend on your specific environment policies. According to GitHub Docs, “For fine-grained personal access tokens, the default the maximum lifetime policy for organizations and enterprises is set to expire within 366 days.”

However, another GitHub Docs page clarifies, “Infinite lifetimes are allowed but may be blocked by a maximum lifetime policy set by your organization or enterprise owner.” For long-running scripts, set a calendar reminder before the expiration date hits.

This flowchart maps out the standard path to limit token scope.

Fine-grained vs. Classic tokens

GitHub provides two different token models. The table below outlines the primary differences between them.

Feature	Fine-grained token	Classic token
Scope	Specific repositories and individual permissions	Broad scopes across all accessible data
Support	Most standard REST API endpoints	Required for Packages and the Checks API
Approval	May require organization administrator approval	Requires the organization to allow classic access

Fine-grained tokens reduce the blast radius if a credential leaks. GitHub Docs advise, "GitHub recommends that you use fine-grained personal access tokens instead, which you can restrict to specific repositories. Fine-grained personal access tokens also enable you to specify fine-grained permissions instead of broad scopes."

Some specialized endpoints still do not support fine-grained permissions. For those edges cases, you must generate a classic token.

Where the credential goes

You pass the token in an HTTP header when making API requests. GitHub Docs explain, "After creating a token, you can authenticate your request by sending the token in the Authorization header of your request."

The standard format uses the Bearer keyword:

Authorization: Bearer YOUR-TOKEN

The same GitHub Docs page notes, "In most cases, you can use Authorization: Bearer or Authorization: token to pass a token."

Personal access tokens do not refresh automatically. When a token expires, you must generate a new one manually. You then update your environment variables or secrets manager with the new string.

GitHub auto-revokes a token if left unused for an extended idle timeout period. You must monitor expiration dates yourself because there is no automated refresh-token flow.

Minimal working example

This example calls the GET /user endpoint. The server returns the public profile of the authenticated token owner. This serves as a reliable smoke test for a new credential.

cURL:

curl -H "Authorization: Bearer $GITHUB_TOKEN" \
     -H "Accept: application/vnd.github+json" \
     -H "X-GitHub-Api-Version: 2026-03-10" \
     https://api.github.com/user

Node.js:

const res = await fetch("https://api.github.com/user", {
  headers: {
    Authorization: `Bearer ${process.env.GITHUB_TOKEN}`,
    Accept: "application/vnd.github+json",
    "X-GitHub-Api-Version": "2026-03-10",
  },
});

const data = await res.json();
console.log(data.login);

Both code blocks include the X-GitHub-Api-Version header. Pinning the version prevents a future API release from breaking your integration. The Accept header explicitly asks the server for a JSON payload.

Using a personal access token with Git (HTTPS)

Developers often use these tokens for local source control operations. According to GitHub Docs, "For example, to clone a repository on the command line you would enter the following git clone command. You would then be prompted to enter your username and password."

When that terminal prompt appears, do not type your standard account password. The same GitHub Docs page states, "Once you have a personal access token, you can enter it instead of your password when performing Git operations over HTTPS."

Typing a long token string on every pull is inefficient. To prevent Git from asking for the token repeatedly, configure a local credential helper. Run this command:

git config --global credential.helper store

This command caches the credential on your local machine. Git reads the cached token automatically on subsequent network operations. Without this helper, automated scripts that rely on HTTPS Git commands will stall waiting for password input.

Common errors and fixes

You may encounter a few standard HTTP errors when testing a new token. Check the response codes to diagnose the issue quickly.

401 Bad credentials
A 401 response means the token is missing, malformed, expired, or revoked. Check the Authorization header format. Ensure the header reads Authorization: Bearer <token> with no extra quotes or trailing spaces. Verify the token still exists in Developer settings.

403 Resource not accessible
Your token lacks the specific scope required by the requested endpoint. For fine-grained tokens, check the X-Accepted-GitHub-Permissions response header. It tells you exactly which permission to add. For classic tokens, you may need to check a broader scope box.

403 or 429 Rate limit exceeded
Unauthenticated requests have a strict rate limit ceiling. Authenticated requests using a personal access token get a significantly higher rate limit ceiling. If the x-ratelimit-remaining header shows zero, check the x-ratelimit-reset header. This value indicates the UTC epoch time when you can retry the request safely.

Using Knit for GitHub API Integrations

With Knit: Managing different token lifecycles becomes complex when your application connects to multiple platforms. You might need to generate a Jira API token, configure Zendesk credentials, or figure out how to create a Slack bot alongside GitHub. Knit provides a unified API to handle authentication across these platforms. You can retrieve connected app metadata using Knit’s GET /integration.details endpoint.

Knit API Request Example:

curl -X GET "https://api.getknit.dev/v1.0/integration.details?originOrgId=YOUR_ORG_ID" \
     -H "Authorization: Bearer YOUR_KNIT_API_KEY" \
     -H "X-Knit-Integration-Id: YOUR_INTEGRATION_ID"

You can read more about connecting multiple platforms in the GitHub API integration guide. You can also explore the GitHub MCP Server for AI agent access.

Frequently Asked Questions

Where do I find my GitHub personal access token after creating it?

You cannot find or view your token string anywhere after creation, as GitHub displays it exactly once right after generation. You cannot view the value again later. If you lose the token string, you must generate a new one. You can view existing token settings and metadata under Developer settings, where you track expiration dates and delete unused keys.

What’s the difference between a fine-grained and a classic personal access token?

Fine-grained tokens restrict access to specific repositories and minimal permissions. Classic tokens use broad scopes that apply across all repositories you can access. GitHub recommends fine-grained tokens for new scripts to improve security. Classic tokens remain necessary only for a few unsupported endpoints.

Can I use a personal access token to access an organization’s repositories?

Yes, if the organization allows it. A token cannot grant permissions you do not personally hold. Organization administrators can enforce approval requirements for any token type. A 403 error against organization repositories usually points to a policy restriction rather than a broken string.

How long does a GitHub personal access token last before I need a new one?

Fine-grained tokens expire based on the date you set during creation. Regarding classic tokens, GitHub Docs note, "Infinite lifetimes are allowed but may be blocked by a maximum lifetime policy set by your organization or enterprise owner." All token types expire automatically if left idle for an extended period.

Is the GitHub API free to use with a personal access token?

Yes. A free token GitHub generates is included with your standard account. Token creation and REST API requests do not incur billing charges. You remain subject to standard rate limits on the platform. If you hit limits frequently across multiple organizations, consider registering a GitHub App.

How to get a GitHub personal access token?

Navigate to Developer settings in your GitHub account, select Personal access tokens, and click Generate new token. Configure your required repository permissions and copy the token value before closing the settings page. Use this string in your API headers and Git operations.