GitHub guide to fine-grained tokens

Fine-grained personal access tokens limit access to one owner, selected repositories, and specific permissions. Use this list to choose only what your command or integration needs.

Repository permissions

36 permissions

Available levels are listed below. “Write” includes read where supported. GitHub documents no separate admin level for these repository permissions; the Administration permission uses read or write.

Permission	Access	What it allows
Actions	Read, write	View or manage workflow runs, jobs, artifacts, caches, and repository runners.
Administration	Read, write	Manage repository settings, access, rules, visibility, transfer, or deletion.
Agent secrets	Read, write	Manage encrypted secrets used by GitHub Copilot coding agents.
Agent tasks	Read, write	Create, view, and manage tasks assigned to GitHub Copilot coding agents.
Agent variables	Read, write	Manage non-secret variables used by GitHub Copilot coding agents.
Artifact metadata	Read, write	Read or create storage and deployment records for published artifacts.
Attestations	Read, write	Read or create artifact provenance and software supply-chain attestations.
Code quality	Read, write	Read or manage code-quality and maintainability findings.
Code scanning alerts	Read, write	View or manage CodeQL and other code-scanning security findings.
Codespaces	Read, write	Create, start, stop, and manage Codespaces for the repository.
Codespaces lifecycle admin	Read, write	Administer the lifecycle of repository Codespaces, including forced stop or deletion.
Codespaces metadata	Read only	View Codespace names, state, machine, owner, and other metadata.
Codespaces secrets	Write only	Manage encrypted secrets available inside Codespaces.
Commit statuses	Read, write	Read or post pending, success, error, and failure statuses on commits.
Contents	Read, write	Read or change code, files, commits, branches, tags, and releases. Write access allows pushes.
Copilot agent settings	Read only	View GitHub Copilot coding-agent configuration for the repository.
Custom properties	Read, write	Read or set organization-defined property values on the repository.
Dependabot alerts	Read, write	View or manage alerts for vulnerable dependencies.
Dependabot secrets	Read, write	Manage encrypted secrets Dependabot uses to access private registries.
Deployments	Read, write	Read or create deployments and update their statuses.
Discussions	Read, write	Read or manage discussions, comments, answers, and moderation.
Environments	Read, write	Manage deployment environments, protection rules, secrets, and variables.
Issues	Read, write	Read or manage issues, comments, labels, milestones, and assignees.
License compliance alerts	Not documented	View or manage alerts for dependencies that violate license policies. Public documentation does not currently confirm its token access levels.
Merge queues	Read, write	View or manage pull requests in a repository merge queue.
Metadata	Read only	Read basic repository information. GitHub includes this permission automatically.
Pages	Read, write	Read or manage GitHub Pages configuration, builds, domains, and deployments.
Pull requests	Read, write	Read or manage pull requests, reviews, comments, and requested reviewers.
Repository security advisories	Read, write	Read, draft, update, and publish private vulnerability advisories.
Secret scanning alert dismissal requests	Read, write	Review requests to dismiss secret-scanning alerts.
Secret scanning alerts	Read, write	View or manage alerts for credentials detected in repository history.
Secret scanning push protection bypass requests	Read, write	Review requests to bypass secret scanning when pushing detected credentials.
Secrets	Read, write	Manage encrypted secrets used by GitHub Actions workflows.
Variables	Read, write	Manage non-secret variables used by GitHub Actions workflows.
Webhooks	Read, write	Read or manage repository webhooks and delivery attempts.
Workflows	Write only	Change files in `.github/workflows`. This permission is write-only.