Personal Access Token
A personal access token provided by GitHub for authentication in place of a password. It is strongly bound to the user account that created it and offers configurable permission scopes, but lacks organization-level management and auditing capabilities.
Core Facts
Timeline (last 90 days)
A Personal Access Token (PAT) usually inherits all of the user's own permissions, so once leaked it is equivalent to the personal account being taken over.
GitLab provides three types of authentication credentials for automated workflows: Personal Access Token (PAT), Project Access Token, and CI Job Token.
GitHub Personal Access Tokens do not automatically expire unless manually configured, and once leaked and undetected, they may remain valid for months or even years
All Facts (5)
GitHub Personal Access Tokens come in two types—Classic and Fine-grained—where Classic has coarser permission granularity and Fine-grained supports permission control down to the repository level.
70%UnverifiedGitHub自2021年起已要求使用Personal Access Token替代密码进行HTTPS认证，并逐步引导用户从SSH迁移到HTTPS工作流
85%UnverifiedA Personal Access Token (PAT) usually inherits all of the user's own permissions, so once leaked it is equivalent to the personal account being taken over.
50%UnverifiedGitLab provides three types of authentication credentials for automated workflows: Personal Access Token (PAT), Project Access Token, and CI Job Token.
50%UnverifiedGitHub Personal Access Tokens do not automatically expire unless manually configured, and once leaked and undetected, they may remain valid for months or even years
50%