Skip to main content
GitHub Docs
Search or ask Copilot
Select language: current language is English
Search or ask Copilot
Open menu
Open Sidebar
  • REST API/
  • Authentication
Home

REST API

  • Quickstart
    • About the REST API
    • Comparing GitHub's APIs
    • API Versions
    • Breaking changes
    • OpenAPI description
    • Getting started
    • Rate limits
    • Pagination
    • Libraries
    • Best practices
    • Troubleshooting
    • Timezones
    • CORS and JSONP
    • Issue event types
    • GitHub event types
    • Authenticating
    • Keeping API credentials secure
    • Endpoints for GitHub App installation tokens
    • Endpoints for GitHub App user tokens
    • Endpoints for fine-grained PATs
    • Permissions for GitHub Apps
    • Permissions for fine-grained PATs
    • Script with JavaScript
    • Script with Ruby
    • Discover resources for a user
    • Delivering deployments
    • Rendering data as graphs
    • Working with comments
    • Building a CI server
    • Get started - Git database
    • Get started - Checks
    • Encrypt secrets
    • Artifacts
    • Cache
    • OIDC
    • Permissions
    • Secrets
    • Self-hosted runner groups
    • Self-hosted runners
    • Variables
    • Workflow jobs
    • Workflow runs
    • Workflows
    • Events
    • Feeds
    • Notifications
    • Starring
    • Watching
    • Organization
    • GitHub Apps
    • Installations
    • OAuth authorizations
    • Webhooks
    • Billing
    • Branches
    • Protected branches
    • Check runs
    • Check suites
    • Alert dismissal requests
    • Code scanning
    • Configurations
    • Codes of conduct
    • Collaborators
    • Invitations
    • Commits
    • Commit comments
    • Commit statuses
    • Alert dismissal requests
    • Alerts
    • Repository access
    • Secrets
    • Dependency review
    • Dependency submission
    • Software bill of materials (SBOM)
    • Deploy keys
    • Deployment branch policies
    • Deployments
    • Environments
    • Protection rules
    • Deployment statuses
    • Emojis
    • Admin stats
    • Announcement
    • Audit log
    • Bypass requests
    • Security features for code
    • Custom properties
    • Custom properties for organizations
    • Global webhooks
    • LDAP
    • Licensing
    • Manage GHES
    • Organization pre-receive hooks
    • GitHub App installations
    • Organizations
    • Pre-receive environments
    • Pre-receive hooks
    • Repository pre-receive hooks
    • Rules
    • SCIM
    • Users
    • Enterprise team members
    • Enterprise team organizations
    • Enterprise teams
    • Gists
    • Comments
    • Blobs
    • Commits
    • References
    • Tags
    • Trees
    • Gitignore
    • Assignees
    • Comments
    • Events
    • Issue dependencies
    • Issue field values
    • Issues
    • Labels
    • Milestones
    • Timeline
    • Licenses
    • Markdown
    • Meta
    • Statistics
    • Organizations
    • Users
    • OAuth app authorizations
    • Bypass requests
    • Custom properties
    • Custom properties for organizations
    • Custom roles
    • Members
    • Organization roles
    • Organizations
    • Outside collaborators
    • Personal access tokens
    • Rule suites
    • Rules
    • Security managers
    • Webhooks
    • Packages
    • Pages
    • Organization configurations
    • Draft Project items
    • Project fields
    • Project items
    • Projects
    • Project views
    • Pull requests
    • Review comments
    • Review requests
    • Reviews
    • Rate limit
    • Reactions
    • Releases
    • Release assets
    • Autolinks
    • Bypass requests
    • Contents
    • Custom properties
    • Forks
    • Git LFS
    • Repositories
    • Rule suites
    • Rules
    • Webhooks
    • Search
    • Alert dismissal requests
    • Push protection bypass
    • Push protection
    • Secret scanning
    • Global security advisories
    • External groups
    • Members
    • Teams
    • Emails
    • Followers
    • GPG keys
    • Git SSH keys
    • Social accounts
    • SSH signing keys
    • Users
  • REST API/
  • Authentication

Authenticating to the REST API

Learn how to authenticate your REST API requests.

  • Authenticating to the REST API, 1 of 7
  • Keeping your API credentials secure, 2 of 7
  • Endpoints available for GitHub App installation access tokens, 3 of 7
  • Endpoints available for GitHub App user access tokens, 4 of 7
  • Endpoints available for fine-grained personal access tokens, 5 of 7
  • Permissions required for GitHub Apps, 6 of 7
  • Permissions required for fine-grained personal access tokens, 7 of 7

Help and support

Did you find what you needed?

Privacy policy

Help us make these docs great!

All GitHub docs are open source. See something that's wrong or unclear? Submit a pull request.

Make a contribution

Learn how to contribute

Still need help?

Ask the GitHub community
Contact support

Legal

  • © 2026 GitHub, Inc.
  • Terms
  • Privacy
  • Status
  • Pricing
  • Expert services
  • Blog