<h1>Fine-Grained Personal Access Tokens</h1>
<p>GitHub doesn't currently access-tokens divorced of the user account. The best method to do this is a <a href="https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens" rel="nofollow noreferrer">fine-grained PAT</a>. You can read the <a href="https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-fine-grained-personal-access-token" rel="nofollow noreferrer">tutorial on how to create a fine-grained access token</a>, but it's pretty easy to figure it out, just follow the prompts here,</p>
<ul>
<li><a href="https://github.com/settings/personal-access-tokens/new" rel="nofollow noreferrer">https://github.com/settings/personal-access-tokens/new</a></li>
</ul>
<p>Alternatively, if you can make the pipeline triggered by the CI, you can use the CI-provided <a href="https://docs.github.com/en/actions/security-guides/automatic-token-authentication" rel="nofollow noreferrer"><code>GITHUB_TOKEN</code></a></p>

CC BY-SA 4.0
2024-02-13T17:30:16.997Z
2024-02-13T17:30:16.997Z
Evan Carroll
<p>What are the best practices for giving build/test pipelines and tools access to GitHub?  Do you just have a single user within the organization provide PATs for each pipeline/tool, or is there a better way to handle it?</p>
<p>For example, say we want to build our product using a Jenkins pipeline. Should we just have a user create a PAT for Jenkins to use to access the GitHub repository?  Is there a way for an org to create a PAT, so it can be managed/owned by the org itself?</p>

<github>
Best practices for giving external pipelines/tools access to GitHub
Tim
# Best practices for giving external pipelines/tools access to GitHub

(Asked by: username_0 on 2024-02-13)

What are the best practices for giving build/test pipelines and tools access to GitHub? Do you just have a single user within the organization provide PATs for each pipeline/tool, or is there a better way to handle it?

For example, say we want to build our product using a Jenkins pipeline. Should we just have a user create a PAT for Jenkins to use to access the GitHub repository? Is there a way for an org to create a PAT, so it can be managed/owned by the org itself?

**Tags:** github


---

## 1 answers

### Answer by username_1 on 2024-02-13. Score: 1

# Fine-Grained Personal Access Tokens

GitHub doesn't currently access-tokens divorced of the user account. The best method to do this is a [fine-grained PAT](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens). You can read the [tutorial on how to create a fine-grained access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-fine-grained-personal-access-token), but it's pretty easy to figure it out, just follow the prompts here,

* <https://github.com/settings/personal-access-tokens/new>

Alternatively, if you can make the pipeline triggered by the CI, you can use the CI-provided [`GITHUB_TOKEN`](https://docs.github.com/en/actions/security-guides/automatic-token-authentication)


---

