What does GitHub Enterprise's 'token lifetime' policy for fine-grained PATs control?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Token lifetime policy is your 'tokens can't live forever' rule. Set a maximum of 30 days and users can't create fine-grained PATs that access your org for 366 days. Forces regular rotation and limits the window of exposure if a token is compromised.
Full explanation below image
Full Explanation
GitHub Enterprise and organizations can configure a token lifetime policy for fine-grained personal access tokens (fine-grained PATs) that limits how long these tokens can remain valid when accessing organizational resources. Policy details: (1) Org owners set a maximum lifetime in days (e.g., 30, 90, 180 days). (2) Users cannot create fine-grained PATs with expiration longer than the policy allows. (3) Existing tokens exceeding the limit may be blocked from org resources. (4) This does NOT affect classic PATs (which can be non-expiring — a separate concern for admins). Benefits: (a) Limits damage window from compromised tokens. (b) Forces regular token rotation discipline. (c) Ensures stale credentials from departed employees automatically expire. This policy works alongside fine-grained PAT approval requirements (org owners can require approval before fine-grained PATs can access org resources).