> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Demo PAT SSO Authorization

> Instructions to authorize a GitHub Personal Access Token with SAML SSO so it can access organization protected resources and avoid 403 errors

Authorize a Personal Access Token (PAT) with SAML so it can access organization-protected resources.

Problem

* When an organization enforces SAML SSO, API requests that use a PAT which hasn't been authorized for that organization will be rejected with a 403 and an explanatory message.

Example unauthenticated request:

```http theme={null}
GET https://api.github.com/repos/game-devstudio/ghas-guardrail-demo/actions/runs
```

Example 403 response:

```json theme={null}
{
  "message": "Resource protected by organization SAML enforcement. You must grant your Personal Access token access to this organization.",
  "documentation_url": "https://docs.github.com/articles/authenticating-to-a-github-organization-with-saml-single-sign-on/",
  "status": "403"
}
```

Cause

* The PAT is valid, but GitHub prevents it from accessing organization-protected resources until the token is explicitly authorized for that organization via SAML SSO.

Fix — authorize the PAT for the organization

1. Open GitHub and go to: Settings → Developer settings → Personal access tokens → Tokens (classic) (or the PAT page you used to create the token).
2. Locate the token you used for the failing request.
3. Click Configure SSO next to that token.
4. In the Configure SSO flow, sign in with your organization credentials and complete any required 2‑factor authentication.
5. Approve the organization authorization. Organization owners will be able to view the token’s scopes and last-used timestamp.

![A dark-themed GitHub single sign-on authorization page prompting to authorize the organization "game-devstudio" with a green "Continue" button. The page also notes owners will be able to see the personal access token's access scopes and usage.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Monitoring-and-Optimization/Demo-PAT-SSO-Authorization/github-sso-authorize-game-devstudio.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=4c7e6e18f189da6591bc6d51489d4c08)

By authorizing the token with SAML, you allow that PAT to act on behalf of your identity for organization-protected resources. Organization owners will be able to view the token's scopes and last-used timestamp.

Validate the authorization

* After authorizing the token through the SSO dialog, re-run the same API request without changing the token. The request should now succeed and return the repository workflow runs.

Successful request example (headers shown):

```http theme={null}
GET https://api.github.com/repos/game-devstudio/ghas-guardrail-demo/actions/runs
Accept: application/vnd.github+json
Authorization: Bearer ghp_4tGctcsOCuOOZDyMrpYtVhT35...
X-GitHub-Api-Version: 2026-03-10
```

Successful response example:

```json theme={null}
{
  "total_count": 46,
  "workflow_runs": [
    {
      "id": 32819140135,
      "name": "Using Reusable CI Workflow",
      "node_id": "WFR_kwLOUBTRK88AAAAHpCxWJw",
      "head_branch": "main",
      "head_sha": "8de63f5e91e37f0f07afa3da0141ff3a2ac67001",
      "path": ".github/workflows/ci.yml",
      "display_title": "Add push trigger to secrets-priority workflow",
      "run_number": 9,
      "event": "push",
      "status": "completed",
      "conclusion": "success"
    }
  ]
}
```

What to expect

* After SSO authorization you should see workflow entries (for example, "Using Reusable CI Workflow" and "Using Composite Workflow" if present). This confirms the PAT is authorized to access organization-protected resources.

Quick reference table

| Issue | Symptom | Resolution |
| - | - | - |
| PAT blocked by SAML SSO | 403 response with SAML enforcement message | On the PAT page click `Configure SSO`, sign in with org credentials, complete 2FA, and grant access |
| Request still failing after SSO | Token not actually authorized, or using wrong token | Re-check the token used in the request and repeat the Configure SSO flow |

Do not share your PAT. When you authorize a token for an organization, owners may view the token's scopes and last-used timestamp. If a token is compromised, revoke it immediately from your Personal access tokens settings.

References

* GitHub Docs: Authenticating to a GitHub organization with SAML single sign-on — [https://docs.github.com/articles/authenticating-to-a-github-organization-with-saml-single-sign-on/](https://docs.github.com/articles/authenticating-to-a-github-organization-with-saml-single-sign-on/)
* Personal access tokens (classic) — [https://docs.github.com/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token](https://docs.github.com/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)

Summary

* A valid PAT may still be blocked from organization resources if SAML SSO is enforced. Authorize the PAT via the PAT page by using Configure SSO and completing the organization authorization. After authorization, API calls using that PAT will succeed for protected resources.

> [card] [Watch Video](https://learn.kodekloud.com/user/courses/github-administration-certification/module/ddb3d739-d57f-4374-b851-69bb14cbeb8b/lesson/a3296c43-9691-41bf-8c53-cd69d3f9112a)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.