Skip to main content
In this lesson we’ll explore GitHub Personal Access Tokens (PATs), comparing classic tokens and fine-grained tokens, showing how organization approval workflows affect token issuance, and where to view active and pending tokens in organization settings. This walkthrough uses the Game Dev Studio organization to demonstrate organization-level controls for PAT creation and management. Where to find Personal Access Token settings
  • User-level: Account → Developer settings → Personal access tokens.
  • Organization-level: Organization → Settings → Security (or Third-party access) → Personal access tokens (where you’ll find Settings, Active tokens, and Pending requests).
Classic personal access tokens Classic tokens use scope-based (coarse) permissions that apply to all repositories your user account can access. You cannot restrict a classic token to a single repository from the token creation flow — selected scopes are global to your user’s repository access. How to create a classic token
  1. Go to Developer settings → Personal access tokens → Tokens (classic).
  2. Click “Generate new token (classic)”.
  3. Provide a note (name), set an expiration, and select scopes (for example, repo).
  4. Generate the token and copy it immediately — classic tokens are issued immediately and do not require organization admin approval.
A screenshot of GitHub's Developer Settings showing the "New personal access token (classic)" form with the note set to "test-token", expiration set to 30 days, and repo-related scopes checked. The left sidebar highlights "Personal access tokens" → "Tokens (classic)".
Key characteristics of classic tokens Fine-grained personal access tokens Fine-grained tokens give you much more control. They allow repository-level selection as well as per-feature permission levels (for example, read vs. read & write for Actions, Codespaces, Issues, and so on). Fine-grained tokens are ideal when you need least-privilege credentials limited to specific repositories and operations. When creating a fine-grained token you can:
  • Select the resource owner (your user account or a specific organization).
  • Choose repository scope: all repositories, public-only, or selected repositories.
  • Configure granular permissions per repository feature (e.g., Actions read, Codespaces write).
  • Set a token expiration.
Example creation flow (organization-owned token)
  1. Choose “Generate new token” → select “for an organization” as the resource owner.
  2. Choose repositories (e.g., only selected repositories).
  3. Set granular permissions and an expiration.
  4. If the organization requires approvals, click “Generate token and request access” — this creates a pending request and the token cannot be used until approved.
A dark-mode screenshot of GitHub's "New Personal Access Token" settings showing "Only select repositories" with game-devstudio/ghas-guardrail-demo selected. The Permissions panel lists Actions, Codespaces, and Metadata access levels and a green "Generate token and request access" button at the bottom.
Pending tokens and admin approval If an organization requires administrator approval for fine-grained tokens, newly generated tokens show up in a pending state and are unusable until an owner or admin approves them. Pending requests include the requester, requested permissions, selected repositories, and any request reason provided. Example token string (UI example — treat as secret if real):
Organization admins can review and act on requests from Organization settings → Personal access tokens → Pending requests.
A screenshot of a GitHub organization settings page showing a fine‑grained personal access token request with a short request reason. The page lists requested repository permissions (e.g., read access to actions and write access to codespaces) and shows Approve and Deny buttons.
Organization settings for fine-grained tokens Organization owners and admins control enforcement settings for fine-grained tokens. Key organization-level controls include:
  • Require administrator approval for fine-grained tokens.
  • Configure a maximum token lifetime (enforce token expiration limits).
These controls help enforce least privilege and lifecycle policies across organization-owned tokens.
Dark-mode screenshot of a GitHub organization's "Personal access tokens" settings page. It shows options to require administrator approval for fine-grained tokens and to set a maximum token lifetime (366 days), with the left navigation menu visible.
Viewing active tokens and usage Organization admins can inspect active personal access tokens and their usage. The Active tokens view typically shows token name, owner, last used timestamp, and the repositories or permissions associated with the token. Use this view to identify stale or over-privileged tokens for rotation or revocation.
A dark-mode screenshot of a GitHub organization settings page for "game-devstudio" showing the "Fine‑grained personal access tokens" area with one token named "fine-grained-token-test" owned by "sid-dev2-kk." The left sidebar lists various organization settings like Billing and plans, Organization roles, Repository roles, Codespaces, and Actions.
Comparing classic and fine-grained tokens Best practices and security notes
Prefer fine-grained tokens for organization access to restrict permissions to only the necessary repositories and actions. Enforce approval workflows and maximum token lifetimes at the organization level to reduce risk.
Treat all PATs as secrets. Do not commit tokens to source control, public gists, or logs. Rotate tokens regularly, set short but practical expirations, and revoke lost or unused tokens immediately.
Links and references If you want, I can add step-by-step screenshots annotated with the exact clicks for your org or create a checklist for token lifecycle management (creation, approval, usage review, rotation, and revocation).

Watch Video