Warning: Treat your access tokens like passwords. For more information, see "Keeping your personal access tokens secure."

Personal access tokens are an alternative to using passwords for authentication to GitHub when using the GitHub API or the command line.

Personal access tokens are intended to access GitHub resources on behalf of yourself. To access resources on behalf of an organization, or for long-lived integrations, you should use a GitHub App. For more information, see "About creating GitHub Apps."

GitHub currently supports two types of personal access tokens: fine-grained personal access tokens and personal access tokens (classic). GitHub recommends that you use fine-grained personal access tokens instead of personal access tokens (classic) whenever possible.

Organization owners can set a policy to restrict the access of personal access tokens (classic) to their organization. For more information, see "为组织设置个人访问令牌策略."

Fine-grained personal access tokens have several security advantages over personal access tokens (classic):

Personal access tokens (classic) 不太安全。 但是，某些功能目前仅适用于 personal access tokens (classic)：

If you choose to use a personal access token (classic), keep in mind that it will grant access to all repositories within the organizations that you have access to, as well as all personal repositories in your personal account.

作为安全预防措施，GitHub 会自动删除一年内未使用过的 personal access token。 为了提供进一步的安全性，强烈建议将过期时间添加到 personal access token。

Personal access tokens are like passwords, and they share the same inherent security risks. Before creating a new personal access token, consider if there is a more secure method of authentication available to you:

If these options are not possible, and you must create a personal access token, consider using another service such as the 1Password CLI to store your token securely, or 1Password's GitHub shell plugin to securely authenticate to GitHub CLI.

When using a personal access token in a script, you can store your token as a secret and run your script through GitHub Actions. For more information, see "加密机密." You can also store your token as a Codespaces secret and run your script in Codespaces. For more information, see "管理代码空间的加密密码."

For more information about best practices, see "Keeping your API credentials secure."

Note: Fine-grained personal access token 目前处于 beta 状态，且可能会更改。 若要留下反馈，请参阅反馈讨论。

Verify your email address, if it hasn't been verified yet.

在任何页面的右上角，单击个人资料照片，然后单击“设置”。

在左侧边栏中，单击“ 开发人员设置”。

In the left sidebar, under Personal access tokens, click Fine-grained tokens.

Click Generate new token.

Under Token name, enter a name for the token.

Under Expiration, select an expiration for the token.

Optionally, under Description, add a note to describe the purpose of the token.

Under Resource owner, select a resource owner. The token will only be able to access resources owned by the selected resource owner. Organizations that you are a member of will not appear unless the organization opted in to fine-grained personal access tokens. For more information, see "为组织设置个人访问令牌策略."

Optionally, if the resource owner is an organization that requires approval for fine-grained personal access tokens, below the resource owner, in the box, enter a justification for the request.

Under Repository access, select which repositories you want the token to access. You should choose the minimal repository access that meets your needs. Tokens always include read-only access to all public repositories on GitHub.

If you selected Only select repositories in the previous step, under the Selected repositories dropdown, select the repositories that you want the token to access.

Under Permissions, select which permissions to grant the token. Depending on which resource owner and which repository access you specified, there are repository, organization, and account permissions. You should choose the minimal permissions necessary for your needs. For more information about what permissions are required for each REST API operation, see "细粒度个人访问令牌所需的权限."

Click Generate token.

If you selected an organization as the resource owner and the organization requires approval for fine-grained personal access tokens, then your token will be marked as pending until it is reviewed by an organization administrator. Your token will only be able to read public resources until it is approved. If you are an owner of the organization, your request is automatically approved. For more information, see "查看和撤销组织中的个人访问令牌".

Note: Organization owners can restrict the access of personal access token (classic) to their organization. If you try to use a personal access token (classic) to access resources in an organization that has disabled personal access token (classic) access, your request will fail with a 403 response. Instead, you must use a GitHub App, OAuth App, or fine-grained personal access token.

Note: Your personal access token (classic) can access every repository that you can access. GitHub recommends that you use fine-grained personal access tokens instead, which you can restrict to specific repositories. Fine-grained personal access tokens also enable you to specify fine-grained permissions instead of broad scopes.

Verify your email address, if it hasn't been verified yet.

在任何页面的右上角，单击个人资料照片，然后单击“设置”。

在左侧边栏中，单击“ 开发人员设置”。

In the left sidebar, under Personal access tokens, click Tokens (classic).

Select Generate new token, then click Generate new token (classic).

In the "Note" field, give your token a descriptive name.

To give your token an expiration, select Expiration, then choose a default option or click Custom to enter a date.

Select the scopes you'd like to grant this token. To use your token to access repositories from the command line, select repo. A token with no assigned scopes can only access public information. For more information, see "OAuth 应用程序的作用域".

Click Generate token.

Optionally, to copy the new token to your clipboard, click .

To use your token to access resources owned by an organization that uses SAML single sign-on, authorize the token. For more information, see "授权用于 SAML 单点登录的个人访问令牌" in the GitHub Enterprise Cloud documentation.

在任何页面的右上角，单击个人资料照片，然后单击“设置”。

在左侧边栏中，单击“ 开发人员设置”。

In the left sidebar, under Personal access tokens, click either Fine-grained tokens or Tokens (classic), depending on which type of personal access token you'd like to delete.

To the right of the personal access token you want to delete, click Delete.

Once you have a personal access token, you can enter it instead of your password when performing Git operations over HTTPS.

For example, to clone a repository on the command line you would enter the following git clone command. You would then be prompted to enter your username and password. When prompted for your password, enter your personal access token instead of a password.

Personal access tokens can only be used for HTTPS Git operations. If your repository uses an SSH remote URL, you will need to switch the remote from SSH to HTTPS.

If you are not prompted for your username and password, your credentials may be cached on your computer. You can update your credentials in the Keychain to replace your old password with the token.

Instead of manually entering your personal access token for every HTTPS Git operation, you can cache your personal access token with a Git client. Git will temporarily store your credentials in memory until an expiry interval has passed. You can also store the token in a plain text file that Git can read before every request. For more information, see "在 Git 中缓存 GitHub 凭据."