Answers: <h1>Fine-Grained Personal Access Tokens</h1>
  <p>GitHub doesn't currently access-tokens divorced of the user account. The best method to do this is a <a href="https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens" rel="nofollow noreferrer">fine-grained PAT</a>. You can read the <a href="https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-fine-grained-personal-access-token" rel="nofollow noreferrer">tutorial on how to create a fine-grained access token</a>, but it's pretty easy to figure it out, just follow the prompts here,</p>
  <ul>
  <li><a href="https://github.com/settings/personal-access-tokens/new" rel="nofollow noreferrer">https://github.com/settings/personal-access-tokens/new</a></li>
  </ul>
  <p>Alternatively, if you can make the pipeline triggered by the CI, you can use the CI-provided <a href="https://docs.github.com/en/actions/security-guides/automatic-token-authentication" rel="nofollow noreferrer"><code>GITHUB_TOKEN</code></a></p>
  
Answers: CC BY-SA 4.0
Answers: 2024-02-13T17:30:16.997Z
Answers: 2024-02-13T17:30:16.997Z
Answers: Evan Carroll
Body: <p>What are the best practices for giving build/test pipelines and tools access to GitHub?  Do you just have a single user within the organization provide PATs for each pipeline/tool, or is there a better way to handle it?</p>
  <p>For example, say we want to build our product using a Jenkins pipeline. Should we just have a user create a PAT for Jenkins to use to access the GitHub repository?  Is there a way for an org to create a PAT, so it can be managed/owned by the org itself?</p>
  
Tags: <github>
Title: Best practices for giving external pipelines/tools access to GitHub
UserDisplayName: Tim
ThreadText: # Best practices for giving external pipelines/tools access to GitHub
  
  (Asked by: username_0 on 2024-02-13)
  
  What are the best practices for giving build/test pipelines and tools access to GitHub? Do you just have a single user within the organization provide PATs for each pipeline/tool, or is there a better way to handle it?
  
  For example, say we want to build our product using a Jenkins pipeline. Should we just have a user create a PAT for Jenkins to use to access the GitHub repository? Is there a way for an org to create a PAT, so it can be managed/owned by the org itself?
  
  **Tags:** github
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2024-02-13. Score: 1
  
  # Fine-Grained Personal Access Tokens
  
  GitHub doesn't currently access-tokens divorced of the user account. The best method to do this is a [fine-grained PAT](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens). You can read the [tutorial on how to create a fine-grained access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-fine-grained-personal-access-token), but it's pretty easy to figure it out, just follow the prompts here,
  
  * <https://github.com/settings/personal-access-tokens/new>
  
  Alternatively, if you can make the pipeline triggered by the CI, you can use the CI-provided [`GITHUB_TOKEN`](https://docs.github.com/en/actions/security-guides/automatic-token-authentication)
  
  
  ---
  
  