github-auth
Installation
SKILL.md
GitHub Authentication
Every credential type below carries a different permission model, a different blast radius, and a different failure message. Picking the wrong one is the most common reason a working script fails in CI.
The credential types
| Type | Identity | Expiry | Scope model | Use for |
|---|---|---|---|---|
| Classic PAT | The user | Optional | Coarse OAuth scopes (repo = all repos, read+write) |
Legacy, and the few APIs fine-grained tokens still cannot reach |
| Fine-grained PAT | The user | Required, max 1 year | Per-repo + per-permission (contents: read) |
The default for a human or a local agent |
| GitHub App installation token | The app, on an installation | 1 hour | Per-permission, per-installation | Automation, bots, anything long-lived |
| GitHub App user access token | The user, via the app | 8 hours (refreshable) | Intersection of app permissions and user access | Acting as the user through an app |
| OAuth App token | The user | None by default | Coarse OAuth scopes | Legacy third-party integrations |
GITHUB_TOKEN |
github-actions[bot] |
The job | permissions: in the workflow |
Anything inside Actions |
OIDC (id-token) |
The workflow, cryptographically | Per-request | Trust policy on the cloud side | Cloud auth from Actions — no stored secret |
| SSH key | The user | None | Full git access as the user | Git transport only, never the API |
| Deploy key | One repository | None | Read or read/write, one repo | CI clone of a single repo |