Home / Passwords & API keys / API keys, one company at a time / GitHub personal access token
GitHub personal access token
Updated Sep 18, 2026
Fine-grained PAT from Settings → Developer settings. Use it as the git password. Never commit it.
You will leave able to git push and gh without GitHub rejecting a password. GitHub passwords do not work on HTTPS anymore. A personal access token is the password. Prefer a fine-grained token over classic.
If HTTPS still feels cursed, skip this page and do SSH keys instead.
Step 1: Open token settings
Signed in at github.com → your avatar → Settings → Developer settings (bottom of the left list) → Personal access tokens → Fine-grained tokens → Generate new token.
Direct: github.com/settings/tokens?type=beta.
Step 2: Least privilege
- Name:
first-app laptop - Expiration: 90 days is enough. Put a reminder. Infinite tokens are how old laptops leak.
- Resource owner: you
- Repository access: Only select repositories → the repo from first repo
- Permissions: Repository Contents: Read and write. Nothing else for a first push. Add Metadata: Read-only if the form requires it.
Generate. Copy the token once. Fine-grained tokens look like github_pat_.... Classic tokens look like ghp_.... Prefer github_pat_.
Step 3: Use it, then store it
git push will ask for a password. The username is your GitHub username. The password is the token, not your GitHub account password.
If you use GitHub CLI:
gh auth login
HTTPS → paste the token when asked.
If a tool needs it in env (Actions, a script, gh in CI), the name is GH_TOKEN in .env and Vercel. Not in git. Not in chat.
.env.example:
GH_TOKEN=
Still fighting HTTPS? SSH key. Next on the path is still a driver, then Env files before any other secret.
Checklist
Saved in this browser. No account. Clearing site data wipes it.
Next: GitHub SSH key · Env files
Get new guides and videos by email
One email when something new is up. No spam. Unsubscribe anytime.