actions/Create GitHub App Token
GitHub Action for creating a GitHub App installation access token
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 12, 2026
- License
- MIT
Pinned Snippet
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| client-id | GitHub App Client ID | no | — |
| app-id | GitHub App ID | no | — |
| private-key | GitHub App private key | yes | — |
| owner | The owner of the GitHub App installation (defaults to current repository owner) | no | — |
| repositories | Comma or newline-separated list of repositories to grant the token access to (defaults to current repository if owner is unset) | no | — |
| enterprise | The slug of the enterprise account where the GitHub App is installed (cannot be used with 'owner' or 'repositories') | no | — |
| skip-token-revoke | If true, the token will not be revoked when the current job is complete | no | false |
| github-api-url | The URL of the GitHub REST API. | — | ${{ github.api_url }} |
| permission-actions | The level of permission to grant the access token for GitHub Actions workflows, workflow runs, and artifacts. Can be set to 'read' or 'write'. | — | — |
| permission-administration | The level of permission to grant the access token for repository creation, deletion, settings, teams, and collaborators creation. Can be set to 'read' or 'write'. | — | — |
| permission-artifact-metadata | The level of permission to grant the access token to create and retrieve build artifact metadata records. Can be set to 'read' or 'write'. | — | — |
| permission-attestations | The level of permission to create and retrieve the access token for repository attestations. Can be set to 'read' or 'write'. | — | — |
| permission-checks | The level of permission to grant the access token for checks on code. Can be set to 'read' or 'write'. | — | — |
| permission-codespaces | The level of permission to grant the access token to create, edit, delete, and list Codespaces. Can be set to 'read' or 'write'. | — | — |
| permission-contents | The level of permission to grant the access token for repository contents, commits, branches, downloads, releases, and merges. Can be set to 'read' or 'write'. | — | — |
| permission-custom-properties-for-organizations | The level of permission to grant the access token to view and edit custom properties for an organization, when allowed by the property. Can be set to 'read' or 'write'. | — | — |
| permission-dependabot-secrets | The level of permission to grant the access token to manage Dependabot secrets. Can be set to 'read' or 'write'. | — | — |
| permission-deployments | The level of permission to grant the access token for deployments and deployment statuses. Can be set to 'read' or 'write'. | — | — |
| permission-discussions | The level of permission to grant the access token for discussions and related comments and labels. Can be set to 'read' or 'write'. | — | — |
| permission-email-addresses | The level of permission to grant the access token to manage the email addresses belonging to a user. Can be set to 'read' or 'write'. | — | — |
| permission-enterprise-custom-properties-for-organizations | The level of permission to grant the access token for organization custom properties management at the enterprise level. Can be set to 'read', 'write', or 'admin'. | — | — |
| permission-environments | The level of permission to grant the access token for managing repository environments. Can be set to 'read' or 'write'. | — | — |
| permission-followers | The level of permission to grant the access token to manage the followers belonging to a user. Can be set to 'read' or 'write'. | — | — |
| permission-git-ssh-keys | The level of permission to grant the access token to manage git SSH keys. Can be set to 'read' or 'write'. | — | — |
| permission-gpg-keys | The level of permission to grant the access token to view and manage GPG keys belonging to a user. Can be set to 'read' or 'write'. | — | — |
| permission-interaction-limits | The level of permission to grant the access token to view and manage interaction limits on a repository. Can be set to 'read' or 'write'. | — | — |
| permission-issues | The level of permission to grant the access token for issues and related comments, assignees, labels, and milestones. Can be set to 'read' or 'write'. | — | — |
| permission-members | The level of permission to grant the access token for organization teams and members. Can be set to 'read' or 'write'. | — | — |
| permission-merge-queues | The level of permission to grant the access token to manage the merge queues for a repository. Can be set to 'read' or 'write'. | — | — |
| permission-metadata | The level of permission to grant the access token to search repositories, list collaborators, and access repository metadata. Can be set to 'read' or 'write'. | — | — |
| permission-organization-administration | The level of permission to grant the access token to manage access to an organization. Can be set to 'read' or 'write'. | — | — |
| permission-organization-announcement-banners | The level of permission to grant the access token to view and manage announcement banners for an organization. Can be set to 'read' or 'write'. | — | — |
| permission-organization-copilot-seat-management | The level of permission to grant the access token for managing access to GitHub Copilot for members of an organization with a Copilot Business subscription. This property is in public preview and is subject to change. Can be set to 'write'. | — | — |
| permission-organization-custom-org-roles | The level of permission to grant the access token for custom organization roles management. Can be set to 'read' or 'write'. | — | — |
| permission-organization-custom-properties | The level of permission to grant the access token for repository custom properties management at the organization level. Can be set to 'read', 'write', or 'admin'. | — | — |
| permission-organization-custom-roles | The level of permission to grant the access token for custom repository roles management. Can be set to 'read' or 'write'. | — | — |
| permission-organization-events | The level of permission to grant the access token to view events triggered by an activity in an organization. Can be set to 'read'. | — | — |
| permission-organization-hooks | The level of permission to grant the access token to manage the post-receive hooks for an organization. Can be set to 'read' or 'write'. | — | — |
| permission-organization-packages | The level of permission to grant the access token for organization packages published to GitHub Packages. Can be set to 'read' or 'write'. | — | — |
| permission-organization-personal-access-token-requests | The level of permission to grant the access token for viewing and managing fine-grained personal access tokens that have been approved by an organization. Can be set to 'read' or 'write'. | — | — |
| permission-organization-personal-access-tokens | The level of permission to grant the access token for viewing and managing fine-grained personal access token requests to an organization. Can be set to 'read' or 'write'. | — | — |
| permission-organization-plan | The level of permission to grant the access token for viewing an organization's plan. Can be set to 'read'. | — | — |
| permission-organization-projects | The level of permission to grant the access token to manage organization projects and projects public preview (where available). Can be set to 'read', 'write', or 'admin'. | — | — |
| permission-organization-secrets | The level of permission to grant the access token to manage organization secrets. Can be set to 'read' or 'write'. | — | — |
| permission-organization-self-hosted-runners | The level of permission to grant the access token to view and manage GitHub Actions self-hosted runners available to an organization. Can be set to 'read' or 'write'. | — | — |
| permission-organization-user-blocking | The level of permission to grant the access token to view and manage users blocked by the organization. Can be set to 'read' or 'write'. | — | — |
| permission-packages | The level of permission to grant the access token for packages published to GitHub Packages. Can be set to 'read' or 'write'. | — | — |
| permission-pages | The level of permission to grant the access token to retrieve Pages statuses, configuration, and builds, as well as create new builds. Can be set to 'read' or 'write'. | — | — |
| permission-profile | The level of permission to grant the access token to manage the profile settings belonging to a user. Can be set to 'write'. | — | — |
| permission-pull-requests | The level of permission to grant the access token for pull requests and related comments, assignees, labels, milestones, and merges. Can be set to 'read' or 'write'. | — | — |
| permission-repository-custom-properties | The level of permission to grant the access token to view and edit custom properties for a repository, when allowed by the property. Can be set to 'read' or 'write'. | — | — |
| permission-repository-hooks | The level of permission to grant the access token to manage the post-receive hooks for a repository. Can be set to 'read' or 'write'. | — | — |
| permission-repository-projects | The level of permission to grant the access token to manage repository projects, columns, and cards. Can be set to 'read', 'write', or 'admin'. | — | — |
| permission-secret-scanning-alerts | The level of permission to grant the access token to view and manage secret scanning alerts. Can be set to 'read' or 'write'. | — | — |
| permission-secrets | The level of permission to grant the access token to manage repository secrets. Can be set to 'read' or 'write'. | — | — |
| permission-security-events | The level of permission to grant the access token to view and manage security events like code scanning alerts. Can be set to 'read' or 'write'. | — | — |
| permission-single-file | The level of permission to grant the access token to manage just a single file. Can be set to 'read' or 'write'. | — | — |
| permission-starring | The level of permission to grant the access token to list and manage repositories a user is starring. Can be set to 'read' or 'write'. | — | — |
| permission-statuses | The level of permission to grant the access token for commit statuses. Can be set to 'read' or 'write'. | — | — |
| permission-team-discussions | The level of permission to grant the access token to manage team discussions and related comments. Can be set to 'read' or 'write'. | — | — |
| permission-vulnerability-alerts | The level of permission to grant the access token to manage Dependabot alerts. Can be set to 'read' or 'write'. | — | — |
| permission-workflows | The level of permission to grant the access token to update GitHub Actions workflow files. Can be set to 'write'. | — | — |
Outputs
| name | description |
|---|---|
| token | GitHub installation access token |
| installation-id | GitHub App installation ID |
| app-slug | GitHub App slug |