> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Personal Access Tokens Classic vs Fine Grained

> Compares security differences between legacy classic personal access tokens and modern fine-grained PATs, focusing on scope, expiry, permissions, auditing, administrative controls, and best practices.

Unmonitored developer tokens are one of the most common vectors for silent credential leaks and large-scale data exfiltration. Understanding the security differences between legacy classic personal access tokens (PATs) and the modern fine-grained personal access tokens is essential for reducing blast radius and improving auditability.

![An infographic titled "Unmonitored Developer Tokens" showing many GitHub-style token strings with a central note "No owner, no expiry, no review" and several tokens highlighted in red. Arrows from the exposed tokens point to consequences labeled "Silent credential leaks" and "Data exfiltration."](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Personal-Access-Tokens-Classic-vs-Fine-Grained/unmonitored-developer-tokens-data-exfiltration.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=25ff4f6d65e6710f1688c9ce2c61b7d9)

This lesson contrasts the security posture of legacy classic personal access tokens with modern, admin-approved, repository-scoped fine-grained personal access tokens. We cover how they differ in scope, expiry, permissions, auditing, and administrative controls.

Classic personal access tokens are simple strings used by developers to call GitHub APIs. Example classic token format:

```text theme={null}
ghp_S4kL9wQ1sTvX8mZ2rB7nJ
```

Example usage calling the API:

```bash theme={null}
curl -H "Authorization: Bearer ghp_S4kL9wQ1sTvX8mZ2rB7nJ" https://api.github.com
```

Think of the two token types as a progression from dangerous convenience (classic) to secure design (fine-grained).

![A slide titled "A Progression, Not a Choice" showing an arrow from a red "Classic" box with a key icon and the tag "Dangerous convenience" to a green "Fine‑grained" box with a card icon and the tag "Secure design."](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Personal-Access-Tokens-Classic-vs-Fine-Grained/progression-not-choice-classic-to-finegrained.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=6debeda0cae74e7856f35d3f2442dba0)

Classic PATs: a master key with a large blast radius

* A classic personal access token functions like a master key for every resource the token owner can access.
* They are simple and powerful, but if leaked they can expose all repositories and resources visible to the user.

![A slide titled "A Master Key" showing a large stylized key next to a grid of service boxes labeled acme-payments, acme-web, acme-infra, and acme-hr. At the bottom are buttons labeled "Simple," "Powerful," and "Terrifying if lost."](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Personal-Access-Tokens-Classic-vs-Fine-Grained/master-key-acme-services-buttons.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=8f5f328f962a08d4589768aaa235fe80)

Scoping and expiry limitations of classic PATs

* When a developer grants the `repo` scope to a classic PAT, that token is authorized for all repositories the user can see across the enterprise — you cannot limit it to a single project.
* Classic PATs can also be created with "No expiration". If compromised, they remain valid until explicitly revoked.

![A UI screenshot for creating a new personal access token (classic) with Expiration set to "No expiration" and a note recommending an expiry date. Below it, a timeline highlights a "Compromised" point and an infinity symbol labeled "Blast radius, indefinite," illustrating the risk.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Personal-Access-Tokens-Classic-vs-Fine-Grained/pat-no-expiration-compromised-blast-radius.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=6511c4a611dc4be5244b6ff7ffa5f078)

Auditability and forensics with classic PATs

* Actions executed with a classic PAT are recorded in audit logs as if the user performed them directly. This can obscure whether an action was performed by the user or by code running with the user's token, complicating investigations.

![A screenshot titled "Recorded as the User" showing an "Organization audit log." It lists two entries — repo.access\_granted and git.push — by user "maya-chen" from 2 and 4 minutes ago.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Personal-Access-Tokens-Classic-vs-Fine-Grained/organization-audit-maya-chen.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=011c35710d74dbb0e9153266bea28dd3)

Fine-grained PATs: programmable key cards with least privilege

* Fine-grained personal access tokens are designed to minimize risk with explicit repository targeting and per-repository permissions. They are closer to role-scoped credentials than master keys.
* When you create a fine-grained PAT you must select which repositories it can access — there is no implicit global repo access.

![A slide titled "Name the Repositories" showing a "Repository access" choice box with three options: Public repositories, All repositories (marked with an X), and Only select repositories (marked as selected).](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Personal-Access-Tokens-Classic-vs-Fine-Grained/name-repositories-repo-access-only-selected.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=d1c1da46f534f4fba1e987c2e7edd742)

Per-repository permissions

* Fine-grained tokens let you set specific permissions per repository (for example: Issues = read-only, Pull requests = write). This supports the principle of least privilege.

![A screenshot of a "Repository permissions" settings panel listing Actions, Contents, Issues, Pull requests, and Secrets with dropdowns. Most entries show "No access" while Issues is set to "Read-only."](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Personal-Access-Tokens-Classic-vs-Fine-Grained/repository-permissions-no-access-issues-readonly.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=abf4ead151e173a6da2f4735fe74f36f)

Mandatory expiration and administrative controls

* Fine-grained PATs require an expiration date; they cannot live forever. This limits the window of exposure if a token is compromised.

![The image shows a UI slide titled "Expiration Is Mandatory" with a dialog for creating a new fine-grained personal access token. The dialog indicates an expiration setting of 30 days and shows "Expires Mar 14, 2026."](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Personal-Access-Tokens-Classic-vs-Fine-Grained/expiration-mandatory-pat-dialog-30-days.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=a8234899d529305b750981e756f12743)

Organization owners can enforce policies that require administrator approval for fine-grained personal access tokens, ensuring tokens undergo review before accessing organization resources.

Example fine-grained token format:

```text theme={null}
github_pat_11ABCDE0Y_9fKx2
```

Comparison: Classic vs Fine-grained Personal Access Tokens

| Feature | Classic personal access token | Fine-grained personal access token |
| - | -: | - |
| Scope | Broad: everything the user can access (e.g., `repo`) | Repository-level: explicitly selected repos only |
| Permissions | Coarse: scopes like `repo`, `admin:org` | Granular: per-repository permissions (actions, contents, issues, PRs, etc.) |
| Expiration | Optional — can be `No expiration` | Mandatory — must set an expiration date |
| Audit clarity | Actions show as the user, can obscure automation vs human | Better mapping between token usage and intended scope |
| Admin controls | Limited — hard to enforce organization approval | Can require admin approval before token can access org resources |
| Typical token format | `ghp_<...>` | `github_pat_<...>` |

Best practices and recommendations

* Prefer fine-grained personal access tokens for new integrations and automations to minimize blast radius through scoped access and mandatory expiration.
* Enforce admin approval and organization-level policies where possible for tokens that access org resources.
* Rotate tokens regularly and treat tokens like secrets: store them in a secrets manager and avoid hard-coding them in source.
* Use audit logs to detect anomalous token activity and revoke compromised tokens immediately.

Tokens with no expiry or overly broad scopes are high-risk. Revoke or rotate any unmonitored classic tokens and migrate integrations to fine-grained personal access tokens where feasible.

Summary

* Classic PATs provide broad, user-scoped access and can be non-expiring — they behave like master keys.
* Fine-grained PATs restrict access to specific repositories, allow per-repo permissions, mandate expiration, and can be subject to admin approval — they enable least-privilege, auditable access.

Links and references

* [Personal access tokens (classic) — GitHub Docs](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)
* [Fine-grained personal access tokens — GitHub Docs](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token#fine-grained-personal-access-tokens)

> [card] [Watch Video](https://learn.kodekloud.com/user/courses/github-administration-certification/module/d477d0b2-5ca0-43b2-aed7-7d82887400f7/lesson/b167aa35-5770-483b-afb1-bac60c574d18)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.