Scope Reference
What a token can do: classic scopes, and the kinds of token GitHub issues.
The classic scope as it appears on a classic PAT or an OAuth App consent screen. | The top-level scope that includes this one. Granting the top-level scope grants all of its sub-scopes. | The highest tier among the permissions the scope reaches, including its sub-scopes.T0: Control-plane equivalent. Full compromise of an org, enterprise, or app identity, or of every repository in it.T1: Management/pipeline plane. Control over deployments, CI/CD, or secrets.T2: User/workload plane. Real but bounded risk: standard collaboration, or stopping work by cutting spend or licenses.T3: Low impact. Reading, or changes that touch no access, code, credentials or availability. | Where the scope can change something, taken from the permissions that set its tier. | How many permissions on the Permissions tab the scope reaches. | REST endpoints whose GitHub docs name this scope. That is the evidence behind the documented permissions. | |
|---|---|---|---|---|---|---|
| admin:enterprise | – | T0 | control | 7 | 15 | ↗▼ |
| admin:org | – | T0 | control | 41 | 209 | ↗▼ |
| repo | – | T0 | management | 64 | 268 | ↗▼ |
| site_admin | – | T0 | control | – | – | ↗▼ |
| admin:org_hook | – | T1 | management | 2 | 11 | ↗▼ |
| admin:public_key | – | T1 | control | 2 | 4 | ↗▼ |
| admin:repo_hook | – | T1 | management | 2 | 2 | ↗▼ |
| delete_repo | – | T1 | management | 1 | 1 | ↗▼ |
| manage_runners:enterprise | admin:enterprise | T1 | management | 1 | – | ↗▼ |
| security_events | repo | T1 | data | 19 | 45 | ↗▼ |
| workflow | – | T1 | data | 2 | 2 | ↗▼ |
| write:org | admin:org | T1 | management | 4 | 17 | ↗▼ |
| write:packages | – | T1 | data | 1 | – | ↗▼ |
| write:public_key | admin:public_key | T1 | control | 1 | 1 | ↗▼ |
| write:repo_hook | admin:repo_hook | T1 | management | 1 | 1 | ↗▼ |
| admin:gpg_key | – | T2 | data | 2 | 4 | ↗▼ |
| codespace | – | T2 | data | 7 | 27 | ↗▼ |
| delete:packages | – | T2 | data | 1 | – | ↗▼ |
| manage_billing:enterprise | admin:enterprise | T2 | data | 1 | – | ↗▼ |
| public_repo | repo | T2 | data | 6 | 4 | ↗▼ |
| read:org | admin:org | T2 | data | 8 | 26 | ↗▼ |
| repo_deployment | repo | T2 | data | 1 | 3 | ↗▼ |
| repo:status | repo | T2 | data | 1 | – | ↗▼ |
| user | – | T2 | control | 4 | 8 | ↗▼ |
| write:gpg_key | admin:gpg_key | T2 | data | 1 | 1 | ↗▼ |
| (no scope) | – | T3 | data | 1 | – | ↗▼ |
| gist | – | T3 | data | 1 | – | ↗▼ |
| notifications | – | T3 | data | – | – | ↗▼ |
| offline_access | – | T3 | data | – | – | ↗▼ |
| project | – | T3 | data | 2 | – | ↗▼ |
| read:audit_log | – | T3 | management | 1 | 1 | ↗▼ |
| read:enterprise | admin:enterprise | T3 | data | 1 | 1 | ↗▼ |
| read:gpg_key | admin:gpg_key | T3 | data | 1 | 2 | ↗▼ |
| read:packages | – | T3 | data | 1 | – | ↗▼ |
| read:project | project | T3 | data | 1 | – | ↗▼ |
| read:public_key | admin:public_key | T3 | control | 1 | 2 | ↗▼ |
| read:repo_hook | admin:repo_hook | T3 | management | 1 | 1 | ↗▼ |
| read:user | user | T3 | data | – | – | ↗▼ |
| repo:invite | repo | T3 | data | – | – | ↗▼ |
| user:email | user | T3 | control | 1 | 2 | ↗▼ |
| user:follow | user | T3 | data | 1 | 2 | ↗▼ |
Scopes from GitHub's scope table; reach from 174 REST reference pages, fetched 2026-10-12.
Token types
Every token is one of these. "Up to" is the highest tier it can carry; a given token's tier is the tier of the scopes or permissions it was given.
| Token | Up to | Carries | Reaches | Lifetime | What decides it |
|---|---|---|---|---|---|
Classic personal access token A token the user creates with classic scopes. It works in every organization the user belongs to. | T0 | Classic scopes (above) | Every organization the user belongs to; SAML SSO orgs also need the token authorized | Expiry optional; an enterprise or org can set a maximum | Its scopes, and the roles of the user who owns it. repo on an organization owner's token reaches Tier 0. Disable classic PATs for the organization where you can, and set a maximum lifetime where you cannot. |
OAuth App token A token an OAuth App holds after a user approves it. Uses the same scopes as a classic PAT and usually does not expire. | T0 | Classic scopes (above) | Every organization the user grants it, unless the org restricts OAuth app access | Usually no expiry; lives until revoked | The scopes on the consent screen, and the roles of the user who approved it. Turn on OAuth App access restrictions so organization data needs an owner's approval. |
Fine-grained personal access token A token for one owner (a user or an organization) and chosen repositories, with permissions from the Permissions tab. Expiry is required. | T0 | Permissions | One resource owner (a user or an org) and the repositories picked for the token | Expiry required; 366 days by default, an enterprise or org can lower it | The permissions picked when it was created, limited by the user's own access. Require approval for fine-grained PATs and keep the maximum lifetime short. |
GitHub App installation token A 1-hour token an App mints with its private key. It has the App's permissions on the installation's repositories, with no user behind it. | T0 | Permissions | The App's permissions, cut down to the installation's repositories (and the user's own access for user tokens) | 1 hour for installation tokens; 8 hours for user tokens, with a 6-month refresh token | The App's permissions and which repositories it is installed on. Whoever holds the private key can mint new ones. Review installed Apps' permissions and install on selected repositories only. |
GitHub App user access token A token an App holds when a user signs in to it. Capped by both the App's permissions and the user's own access. 8 hours, refreshable for 6 months. | T0 | Permissions | The App's permissions, cut down to the installation's repositories (and the user's own access for user tokens) | 1 hour for installation tokens; 8 hours for user tokens, with a 6-month refresh token | The lower of the App's permissions and the user's role. Treat the refresh token as the long-lived secret it is. |
GITHUB_TOKEN The token every workflow job gets for its own repository, valid for the job. Its permissions come from the workflow's permissions block or the repository default. | T1 | Permissions | The one repository the workflow runs in | The job's duration | The permissions block in the workflow, falling back to the organization or repository default. Set the default to read-only and grant write per job. |