Check fine-grained GitHub token ownership and approval before diagnosing denied access

Token permissions work inside the selected owner and the user’s own access, with approval status adding another boundary.

Source facts

GitHub fine-grained personal access tokens target one resource owner and can be limited to selected repositories and permissions. A token cannot grant capabilities its user does not have. Organizations may require approval; a pending token can read only public resources until approved. GitHub documents feature limitations and recommends GitHub Apps for organization-owned or long-lived integrations.

Source: GitHub — Managing your personal access tokens.

Applicability

This concerns fine-grained personal access tokens. It does not describe the built-in Actions token or establish that every endpoint supports a fine-grained token.

DSE recommendation

DSE recommends recording the intended owner, repositories, actions, expiration and user dependency before requesting a token. Check approval state and the endpoint’s documented token requirements when access fails. Avoid broadening repository scope or switching to a classic token until the missing requirement is understood. Choose a service identity appropriate to the integration’s lifetime and assign someone to review access when the user’s role changes. Make the integration owner explain the selected resource owner and required endpoints before choosing permissions. Retain an approval-state check in troubleshooting, and plan replacement when the owning person leaves instead of depending on a successful request from an earlier test.

Verification

Proposed verification: in an approved test integration, inspect nonsecret token metadata and exercise one permitted endpoint plus a deliberately out-of-scope request. Verify pending-approval behavior where applicable. Record the owner, selected resources and outcomes without exposing the token, and confirm the application has a documented renewal or replacement path.

Official reference

GitHub — Managing your personal access tokens. Reviewed October 20, 2026.