Unverified50% confidenceFactExact time
A GitHub App signs a JWT with its private key, then exchanges it for a short-term installation token to perform operations, and the permission granularity can be precise down to a single repository and specific APIs.
1
Sources
50%
Confidence
Long-term
Relevance
10/13/2026
First Seen
Sources
Related Entities
Related Claims
VerifiedPlatforms such as GitHub Actions and GitLab CI grant runners write access to repositories by default through built-in credentials such as GITHUB_TOKEN.75% similarUnverifiedWhen GitHub Actions federates to AWS via OIDC, GitHub acts as the OIDC identity provider and issues short-lived JWTs for workflows containing claims such as repository name, branch name, trigger event type, workflow name, and runtime environment.72% similarUnverifiedGitHub Apps delegate permissions on a per-installation basis, which can be precisely limited to specific repositories and operation types, and are decoupled from user identity through independent Installation Access Tokens72% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1014983API
curl https://kongchang.com/api/v1/knowledge/claims/1014983MCP
get_claim(id=1014983)