What is a GitHub 'fine-grained personal access token' and how does it differ from classic PATs?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Fine-grained PATs are the principle of least privilege applied to personal tokens. Instead of 'all repos + write access to everything,' you specify exactly which repositories and exactly which permissions. Your repo-specific deploy token can't touch any other repo.
Full explanation below image
Full Explanation
Fine-grained personal access tokens represent a significant security improvement over classic PATs: (1) Repository scope — specify exact repositories the token can access (0 to all user repos or selected org repos with owner approval). Classic PATs can't limit which repos they access. (2) Individual permissions — each permission type (contents, issues, pull requests, actions) is specified separately with read, write, or no access. Classic PATs use broad scopes (repo, admin:org). (3) Expiration — fine-grained PATs have required expiration dates (max 366 days). (4) Organization approval — org owners can require fine-grained PATs to be approved before accessing org resources. (5) Audit log — provides better attribution with token name in logs. Classic PATs still exist for backward compatibility but fine-grained PATs should be preferred for new automation.