jprdonnelly/docs
1
0
Fork 0
mirror of synced 2025-12-19 18:10:59 -05:00
Code Issues Projects Releases Wiki Activity

Credential revocation REST API endpoint (#55233)

Browse Source 
Co-authored-by: Jules Porter <jules-p@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Anne-Marie <102995847+am-stead@users.noreply.github.com>
Co-authored-by: Greg Ose <gregose@github.com>
Co-authored-by: Sarita Iyer <66540150+saritai@users.noreply.github.com>
Co-authored-by: Usha N <n-usha@github.com>
This commit is contained in:
Jules
2025-04-29 19:56:04 +02:00
committed by GitHub
parent 193f0e8ea1
commit 5862cadbad
4 changed files with 31 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
content/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens.md
View File

@@ -145,6 +145,9 @@ You should delete a {% data variables.product.pat_generic %} if it is no longer
1. In the left sidebar, under **{% octicon "key" aria-hidden="true" %} {% data variables.product.pat_generic_caps %}s**, click either **Fine-grained tokens** or **Tokens (classic)**, depending on which type of {% data variables.product.pat_generic %} you'd like to delete.
1. To the right of the {% data variables.product.pat_generic %} you want to delete, click **Delete**.
{% ifversion ghec or fpt %}> [!NOTE] If you find a leaked {% data variables.product.pat_generic %} belonging to someone else, you can submit a revocation request through the REST API. See [AUTOTITLE](/code-security/getting-started/best-practices-for-preventing-data-leaks-in-your-organization#mitigate-data-leaks).
{% endif %}
## Using a {% data variables.product.pat_generic %} on the command line
Once you have a {% data variables.product.pat_generic %}, you can enter it instead of your password when performing Git operations over HTTPS.

12
content/authentication/keeping-your-account-and-data-secure/token-expiration-and-revocation.md
View File

@@ -45,6 +45,18 @@ You can revoke your authorization of a {% data variables.product.prodname_github
Once an authorization is revoked, any tokens associated with the authorization will be revoked as well. To reauthorize an application, follow the instructions from the third-party application or website to connect your account on {% data variables.product.prodname_dotcom %} again.
{% ifversion fpt or ghec %}
## Token revoked by a third party
To prevent unauthorized access using exposed tokens, {% data variables.product.github %} recommends token revocation to ensure that a token can no longer be used to authenticate to {% data variables.product.github %}. If you find another user's {% data variables.product.pat_generic %} leaked on {% data variables.product.github %} or elsewhere, you can submit a revocation request through the REST API. See [AUTOTITLE](/rest/credentials/revoke#revoke-a-list-of-credentials).
If a valid {% data variables.product.pat_generic %} is submitted to {% data variables.product.github %}'s credential revocation API, the token will be automatically revoked. This API allows a third party to revoke a token they do not own and helps protect the data associated with this token from unauthorized access, limiting the impact of exposed tokens.
To encourage reports and ensure that exposed tokens can be quickly and easily revoked, we do not require authentication for the revocation requests submitted through the API. As a result, {% data variables.product.github %} is unable to provide further information about the source of the reported token.
{% endif %}
## Token revoked by the {% data variables.product.prodname_oauth_app %}
The owner of an {% data variables.product.prodname_oauth_app %} can revoke an account's authorization of their app, this will also revoke any tokens associated with the authorization. For more information about revoking authorizations of your {% data variables.product.prodname_oauth_app %}, see [AUTOTITLE](/rest/apps/oauth-applications#delete-an-app-authorization).