Which type of token should an administrator use to authenticate GitHub Actions workflows with fine-grained, repository-scoped permissions?
Select an answer to reveal the explanation.
Short Explanation and Infographic
The GITHUB_TOKEN is GitHub's built-in solution for Actions authentication. It's automatically generated for each workflow run, scoped to the repository, and expires when the job ends. No secrets to manage, no rotation anxiety.
Full explanation below image
Full Explanation
The GITHUB_TOKEN is a special authentication token automatically created by GitHub Actions for each workflow run. It is scoped to the repository where the workflow runs and has permissions configured in the workflow YAML or repository settings. It expires when the workflow job completes, eliminating the risk of long-lived credential exposure. Personal Access Tokens (classic) are user-level, not repository-scoped, and have broad permissions making them less secure for automation. OAuth App tokens act as the authorizing user. SSH deploy keys are for Git operations only and cannot authenticate API calls. GITHUB_TOKEN is the recommended approach for most Actions automation.