Getting a GitHub Personal Access Token - A Complete Guide

May 08, 2026

If you’re building applications that interact with GitHub—whether you’re automating workflows, syncing repositories, or connecting GitHub with tools like Sequels.diy you’ll need a secure way to authenticate. That’s where Personal Access Tokens come in. They’re the recommended way to access GitHub programmatically, replacing the need to expose your main password. In this guide, we’ll walk you through creating, configuring, and securely managing your tokens so you can start automating with confidence.

What is a Personal Access Token?

A Personal Access Token (PAT) is basically like a password, but specifically for accessing GitHub through code or scripts. Instead of using your actual GitHub password, you create a token that has specific permissions. This is way safer because if something goes wrong, you can just delete the token without changing your whole password.

Why Do You Need It?

You need a Personal Access Token for a bunch of different stuff:

• Repository Notifications - Get alerts when there are new issues or pull requests
• Repository Events - Monitor when someone pushes code, creates releases, etc.
• Releases & Commits - Track new versions and code changes
• Issues & Pull Requests - Keep tabs on open/closed issues and PRs
• Gists - Get notified about new gists
• User Activity - Monitor activity from specific users or organizations

Basically, if you want to automate anything with GitHub, you’ll need a Personal Access Token!

Step-by-Step Guide to Create One

Step 1: Go to GitHub Settings

First, log in to your GitHub account. Then:

• Click on your profile picture in the top-right corner
• Select Settings from the dropdown menu

Step 2: Navigate to Developer Settings

On the left sidebar, scroll down and click on Developer settings (it’s at the very bottom of the list).

Step 3: Go to Personal Access Tokens

In the Developer settings page, on the left sidebar, you’ll see Personal access tokens. Click on it and select Tokens (classic).

Step 4: Generate a New Token

Click the Generate new token button and select Generate new token (classic).

Step 5: Configure Your Token

Now comes the important part - setting up what your token can do.

Give it a name - Something descriptive like “GitHub Automation” or “My App Integration”

Set an expiration - You can choose how long the token is valid. I usually pick 30 or 90 days just to be safe. You can always create a new one later.

Select scopes - This is where you choose what permissions the token has. Here’s what you probably need depending on what you want to do:

For Repository Notifications:

• repo - Full control of private repositories
• notifications - Access to notifications

For Repository Events & Commits:

• repo - Full control of private repositories
• read:repo_hook - Read repository hooks

For Releases:

• repo - Full control of private repositories

For Issues & Pull Requests:

• repo - Full control of private repositories

For Gists:

• gist - Create gists

For User Activity (Public):

• public_repo - Access public repositories
• read:user - Read user profile data
• user:email - Access email addresses

Pro tip: Start with minimal permissions. If you find out later that you need more, you can always create another token with more permissions.

Step 6: Generate and Copy

Once you’ve selected your scopes, click the green Generate token button at the bottom.

⚠️ IMPORTANT: GitHub will show you the token only once! Copy it and save it somewhere safe (like a password manager or a secure file). Once you leave this page, you won’t be able to see it again. If you lose it, you’ll have to generate a new one.

Using Your Token

When you need to use the token in your code or scripts, it usually looks something like this:

ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Command Line Example:

git clone https://github.com/username/repo.git
# When prompted for password, use your token instead

API Example:

curl -H "Authorization: token ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  https://api.github.com/user

Security Tips

1. Never share your token - Treat it like a password
2. Don’t commit it to GitHub - Don’t accidentally push it to a public repo
3. Use environment variables - Store it in a .env file (and add .env to .gitignore)
4. Delete old tokens - If you’re not using it anymore, delete it
5. Check regularly - Go back to your token settings and see which tokens are active

Revoking a Token

If you think your token got compromised or you just don’t need it anymore:

1. Go to Settings → Developer settings → Personal access tokens
2. Find the token you want to delete
3. Click Delete

That’s it! The token is gone and can’t be used anymore.

Troubleshooting

“Invalid token” error?

• Make sure you copied it correctly
• Check if it’s expired (tokens have expiration dates!)
• If expired, generate a new one

“Insufficient permissions” error?

• The token doesn’t have the right scopes
• Generate a new token with the permissions you need

Can’t find Personal Access Tokens in settings?

• Make sure you’re in Developer settings, not just regular Settings
• Check if you’re logged in with the right account

Final Thoughts

Honestly, Personal Access Tokens seem scary at first, but they’re super useful once you get the hang of them. Just remember to keep them safe and delete them when you don’t need them anymore. Good luck with your GitHub automation! 🚀

Have questions? Drop them in the comments! And if this helped you, feel free to share it with other people learning GitHub API stuff.