Demo PAT SSO Authorization

Authorize a Personal Access Token (PAT) with SAML so it can access organization-protected resources. Problem

When an organization enforces SAML SSO, API requests that use a PAT which hasn’t been authorized for that organization will be rejected with a 403 and an explanatory message.

Example unauthenticated request:

GET https://api.github.com/repos/game-devstudio/ghas-guardrail-demo/actions/runs

Example 403 response:

{
  "message": "Resource protected by organization SAML enforcement. You must grant your Personal Access token access to this organization.",
  "documentation_url": "https://docs.github.com/articles/authenticating-to-a-github-organization-with-saml-single-sign-on/",
  "status": "403"
}

Cause

The PAT is valid, but GitHub prevents it from accessing organization-protected resources until the token is explicitly authorized for that organization via SAML SSO.

Fix — authorize the PAT for the organization

Open GitHub and go to: Settings → Developer settings → Personal access tokens → Tokens (classic) (or the PAT page you used to create the token).
Locate the token you used for the failing request.
Click Configure SSO next to that token.
In the Configure SSO flow, sign in with your organization credentials and complete any required 2‑factor authentication.
Approve the organization authorization. Organization owners will be able to view the token’s scopes and last-used timestamp.

A dark-themed GitHub single sign-on authorization page prompting to authorize the organization "game-devstudio" with a green "Continue" button. The page also notes owners will be able to see the personal access token's access scopes and usage.

By authorizing the token with SAML, you allow that PAT to act on behalf of your identity for organization-protected resources. Organization owners will be able to view the token’s scopes and last-used timestamp.

Validate the authorization

After authorizing the token through the SSO dialog, re-run the same API request without changing the token. The request should now succeed and return the repository workflow runs.

Successful request example (headers shown):

GET https://api.github.com/repos/game-devstudio/ghas-guardrail-demo/actions/runs
Accept: application/vnd.github+json
Authorization: Bearer ghp_4tGctcsOCuOOZDyMrpYtVhT35...
X-GitHub-Api-Version: 2026-03-10

Successful response example:

{
  "total_count": 46,
  "workflow_runs": [
    {
      "id": 32819140135,
      "name": "Using Reusable CI Workflow",
      "node_id": "WFR_kwLOUBTRK88AAAAHpCxWJw",
      "head_branch": "main",
      "head_sha": "8de63f5e91e37f0f07afa3da0141ff3a2ac67001",
      "path": ".github/workflows/ci.yml",
      "display_title": "Add push trigger to secrets-priority workflow",
      "run_number": 9,
      "event": "push",
      "status": "completed",
      "conclusion": "success"
    }
  ]
}

What to expect

After SSO authorization you should see workflow entries (for example, “Using Reusable CI Workflow” and “Using Composite Workflow” if present). This confirms the PAT is authorized to access organization-protected resources.

Quick reference table

Issue	Symptom	Resolution
PAT blocked by SAML SSO	403 response with SAML enforcement message	On the PAT page click `Configure SSO`, sign in with org credentials, complete 2FA, and grant access
Request still failing after SSO	Token not actually authorized, or using wrong token	Re-check the token used in the request and repeat the Configure SSO flow

Do not share your PAT. When you authorize a token for an organization, owners may view the token’s scopes and last-used timestamp. If a token is compromised, revoke it immediately from your Personal access tokens settings.

References

GitHub Docs: Authenticating to a GitHub organization with SAML single sign-on — https://docs.github.com/articles/authenticating-to-a-github-organization-with-saml-single-sign-on/
Personal access tokens (classic) — https://docs.github.com/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token

Summary

A valid PAT may still be blocked from organization resources if SAML SSO is enforced. Authorize the PAT via the PAT page by using Configure SSO and completing the organization authorization. After authorization, API calls using that PAT will succeed for protected resources.

Course Introduction

Foundation Setup

Identity and Access Management

Governance and Roles

Security and Compliance

GitHub Actions and Runners

Administration and Support

Monitoring and Optimization

Demo PAT SSO Authorization

Watch Video