How to create a fine-grained personal access token in GitHub
Open Settings, then Developer settings, then Personal access tokens, then Fine-grained tokens, and click Generate new token. Set an expiry, choose the repositories, grant only the permissions needed and click Generate token, then copy the github_pat_ value once.
This is for someone giving a coding agent, a script or a tool access to GitHub without handing over the whole account. A fine-grained token is tied to chosen repositories and named permissions, and it expires. Most failures come from picking the wrong resource owner, leaving out a repository, or forgetting a permission such as Contents write.
Before you start
You need a GitHub account. To scope a token to an organisation's repositories, the organisation must allow fine-grained tokens and may require an owner's approval.
- Time
- About 3 minutes
- Account
- Not walked yet
-
1
Open Developer settings
Click your avatar at the top right, choose Settings, then click Developer settings at the bottom of the left menu.
You should see: A page with GitHub Apps, OAuth Apps and Personal access tokens in the left menu.
-
2
Open Fine-grained tokens
Click Personal access tokens, then Fine-grained tokens.
You should see: A list of your fine-grained tokens, with a Generate new token button.
-
3
Click Generate new token
Click Generate new token. GitHub may ask you to confirm with your password or a passkey.
You should see: A form with Token name, Resource owner, Expiration and Description.
-
4
Name it, pick the owner and the expiry
Enter a Token name that says who holds it, such as Coding agent. Set Resource owner to your account or the organisation that owns the repositories. Choose an Expiration.
You should see: The name, owner and expiry date shown.
-
5
Choose the repositories
Under Repository access, choose Only select repositories and pick the repositories the tool needs. Avoid All repositories.
You should see: The chosen repositories listed under the selector.
-
6
Grant the permissions
Under Permissions, open Repository permissions and set only what the tool needs, such as Contents to Read and write and Pull requests to Read and write. Leave the rest at No access.
You should see: A summary near the bottom listing the permissions you granted.
-
7
Generate and copy the token
Click Generate token, then copy the value starting github_pat_ into the tool's secret store. Never paste it into chat or commit it.
You should see: The new token listed under Fine-grained tokens with its expiry date.
If it does not work
The tool gets 403 Resource not accessible by personal access token. The token lacks a permission for that call, often Contents write, Pull requests write or Workflows write. Open the token, click Edit, and add the permission. The value stays the same.
The tool gets 404 Not Found for a repository that exists. The repository is not in the token's Repository access, or the Resource owner is wrong. Edit the token to add the repository, or create one owned by the organisation.
The organisation's repositories do not appear, or the token is listed as pending. The organisation needs an owner to approve fine-grained tokens. Ask an owner to approve the request under the organisation's Personal access tokens settings.
The tool stopped working after weeks with a 401. The token expired. Open it under Fine-grained tokens and click Regenerate token, then update the tool with the new value.
Questions
Fine-grained or classic token, which should I use?
Fine-grained, unless the tool says it only supports classic. A fine-grained token is limited to chosen repositories and permissions and must expire. A classic token with the repo scope reaches every repository you can access.
What permissions does a coding agent need to push and open pull requests?
Typically Contents read and write and Pull requests read and write on the chosen repositories. Metadata read is added automatically. Add Workflows write only if it must edit files under .github/workflows.
How long can the token last?
You pick an expiry, such as 30, 60 or 90 days or a custom date. Organisations can set a maximum lifetime. GitHub emails you before it expires, and you can regenerate it with the same settings.
Why can the token not see an organisation's repository?
The Resource owner was set to your personal account, or the organisation requires approval and the request is still pending. Create the token with the organisation as Resource owner and check its approval status.
Can I see the token again later?
No. GitHub shows it once on the page after you generate it. If you lose it, click Regenerate token on its page and update the tool.
How we checked
Verified 11 Oct 2026 against the live interface on not walked yet.
Related guides
Ready to do it?
Run these 7 steps on your own GitHub page. Each step shows in a panel on the page, Next when you are ready.