GitHub Enhances Credential Revocation with Token-Type Specificity
GitHub has rolled out new capabilities allowing enterprise owners and organization admins to revoke and deauthorize user credentials based on their token type, such as Personal Access Tokens or SSH keys. This enhancement provides finer-grained control during security incidents, significantly reducing the blast radius of a compromise by not requiring a complete revocation of all user credentials. The new functionality is available via both the UI and REST APIs, and actions are captured in audit logs with email notifications for affected users. It extends previously enterprise-level bulk actions to the organization level.
- →Token-Type-Specific Bulk Deauthorization
- →Token-Type-Specific Bulk Revocation
- →Organization-Level Parity for Revocation Actions
- →Auditing and Visibility for Credential Actions
Features (4) ›
- Token-Type-Specific Bulk Deauthorization
Users can now revoke all SSO authorizations for a specific credential type across an enterprise or for a specific user from the UI or enterprise REST APIs, avoiding the need to deauthorize all types simultaneously.
- Token-Type-Specific Bulk Revocation
This allows for deleting or revoking all user-level credentials of a specific type, such as all personal access tokens for an individual user, without affecting other credential types like SSH keys.
- Organization-Level Parity for Revocation Actions
All bulk credential-revocation actions previously exclusive to the enterprise level are now also available at the organization level through both the web UI and organization REST APIs, facilitating incident response for organizations.
- Auditing and Visibility for Credential Actions
All deauthorization and revocation actions are now captured in the audit log, ensuring accountability and traceability, and affected users receive notifications via email.
https://github.blog/changelog/2026-08-18-credential-revocation-and-deauthorization-by-token-type
Related releases
- GitHub improves tools for managing blocked users GitHub Changelog ·
- Shared agentic work with GitHub Copilot in Microsoft Teams GitHub Changelog ·
- GitHub Copilot Integrates with Slack for Agentic Development Workflows GitHub Changelog ·
- GitHub's Issues Sidebar Now Supports Pinned Views, Plus Other Enhancements GitHub Changelog ·
- Windows 11 ARM64 VS2026 image generally available for GitHub Actions GitHub Changelog ·
- Code scanning adds a mitigated alert dismissal reason GitHub Changelog ·