githuganswered from live GitHub & Hugging Face data
What are the differences in scope and expiry between fine-grained PATs and GitHub App installation tokens for coding agents?
Common assumption: a fine-grained PAT is the safe choice for an agent. For a coding agent, a GitHub App installation token is the better default, because it expires after one hour and its scope is narrower.
Comparison
| Property | Fine-grained PAT | GitHub App installation token |
|---|---|---|
| Owner of the credential | A single user. The token stops working if that user loses access to the resource. | The app installation. It is not tied to a user, and it stays installed if the installer leaves the organization. |
| Expiry | You choose the expiration. Infinite lifetimes are allowed, but an organization or enterprise maximum lifetime policy can block them. | Expires after 1 hour. |
| Repository scope | One resource owner (user or organization). You select specific repositories, or choose all repositories. | Repositories granted at installation. You can narrow each token with repositories or repository_ids (up to 500). |
| Permission scope | Fine-grained permissions, set when the token is created. | Permissions granted to the app. A token gets all of them unless you pass permissions to narrow it. A token cannot gain permissions the app lacks. |
| Revocation | Revoke the token, or it is removed automatically after one year without use. | Revoke the app authorization, or let the one-hour token expire. |
| Rate limits | Tied to the user. | Scales with the number of repositories and organization users. |
Sources: Managing your personal access tokens, Generating an installation access token for a GitHub App, Token expiration and revocation, Deciding when to build a GitHub App.
Limits of fine-grained PATs for agents
Fine-grained PATs cannot do several tasks. The docs list these gaps:
- Contributing to public repositories where the user is not a member.
- Contributing as an outside collaborator.
- Accessing more than one organization at once.
- Accessing Packages.
- Calling the Checks API.
- Accessing user-owned Projects.
If an agent needs one of these, a fine-grained PAT cannot cover it. A classic PAT can, but it has broad scope. The docs say it reaches all repositories in your organizations and all personal repositories.
Other points to check
- User-to-server tokens from a GitHub App expire after 8 hours by default. They act on behalf of a user. The refresh token renews them.
- Set an expiration on every PAT. The docs say an unused PAT is removed after one year. Any token pushed to a public repository is revoked automatically.
- A token limit applies to PATs. You can create up to 50 fine-grained PATs. The docs suggest a GitHub App for automation at scale.
Recommendation
Use a GitHub App installation token for coding agents. It gives short expiry, per-repository scope, and permissions you can narrow for each request. Use a fine-grained PAT only for a single-user script on repositories you own, with a short expiration.
- Choose a GitHub App if you run agents on several repositories or in an organization. It also applies if you need the one-hour expiry.
- Choose a fine-grained PAT if one person runs a short script against resources they already access.
If you want each agent to have its own identity, githug does this today. Each agent gets its own key. That key mints installation tokens that last one hour and work on one repository, through a GitHub App.