jprdonnelly/docs
1
0
Fork 0
mirror of synced 2025-12-19 18:10:59 -05:00
Code Issues Projects Releases Wiki Activity

[Improvement]: Add section that describes the factors that determine what a PAT can access (#51694)

Browse Source
This commit is contained in:
Vanessa
2024-08-01 08:49:55 +10:00
committed by GitHub
parent 4436831736
commit 8e546befc8
5 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
content/apps/creating-github-apps/authenticating-with-a-github-app/authenticating-with-a-github-app-on-behalf-of-a-user.md
View File

@@ -31,6 +31,8 @@ Once a user has authorized your app, you can generate a user access token, which
Requests made with a user access token are sometimes called "user-to-server" requests.
{% data reusables.user-settings.token_access_capabilities %}
If you want to attribute app activity to the app instead of to a user, you should authenticate as an app installation instead. For more information, see "[AUTOTITLE](/apps/creating-github-apps/authenticating-with-a-github-app/authenticating-as-a-github-app-installation)."
{% note %}

2
content/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps.md
View File

@@ -51,6 +51,8 @@ When you want to use an {% data variables.product.prodname_oauth_app %} that int
{% endtip %}
{% data reusables.user-settings.token_access_capabilities %} For example, an application can create an access token that is configured with an `admin:org` scope, but if the user of the application is not an organization owner, the application will not be granted administrative access to the organization.
{% data reusables.apps.oauth-token-limit %}
### Types of requested data

2
content/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens.md
View File

@@ -33,6 +33,8 @@ For more information, see "[Keeping your {% data variables.product.pat_generic %
{% data variables.product.pat_generic_caps %}s are intended to access {% data variables.product.company_short %} resources on behalf of yourself. To access resources on behalf of an organization, or for long-lived integrations, you should use a {% data variables.product.prodname_github_app %}. For more information, see "[AUTOTITLE](/apps/creating-github-apps/setting-up-a-github-app/about-creating-github-apps)."
{% data reusables.user-settings.token_access_capabilities %} For example, a {% data variables.product.pat_generic %} can be configured with an `admin:org` scope, but if the owner of the token is not an organization owner, the token will not give administrative access to the organization.
{% ifversion pat-v2 %}
### Types of {% data variables.product.pat_generic %}s

2
content/rest/authentication/keeping-your-api-credentials-secure.md
View File

@@ -34,6 +34,8 @@ When creating a {% data variables.product.pat_generic %}, only select the minimu
{% endif %}
{% data reusables.user-settings.token_access_capabilities %}
When creating a {% data variables.product.prodname_github_app %}, select the minimum permissions that your {% data variables.product.prodname_github_app %} will need. For more information, see "[AUTOTITLE](/apps/creating-github-apps/setting-up-a-github-app/best-practices-for-creating-a-github-app)."
When authenticating with `GITHUB_TOKEN` in a {% data variables.product.prodname_actions %} workflow, only give the minimum amount of permissions needed. For more information, see "[AUTOTITLE](/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token)."

1
data/reusables/user-settings/token_access_capabilities.md Normal file
View File

@@ -0,0 +1 @@
A token has the same capabilities to access resources and perform actions on those resources, that the owner of the token has, and is further limited by any scopes or permissions granted to the token. A token cannot grant additional access capabilities to a user.