{"id":49321,"date":"2025-05-14T02:32:33","date_gmt":"2025-05-14T02:32:33","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=49321"},"modified":"2026-02-21T07:28:21","modified_gmt":"2026-02-21T07:28:21","slug":"what-is-github-app-installation-token","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/what-is-github-app-installation-token\/","title":{"rendered":"What is GitHub App Installation Token?"},"content":{"rendered":"\n

A GitHub App Installation Token<\/strong> is a short-lived access token<\/strong> that allows a GitHub App to interact with specific repositories or organizations<\/strong> where it has been installed \u2014 on behalf of itself, not a user.<\/p>\n\n\n\n

\n\n\n\n

\ud83d\udd10 Why is it Needed?<\/h2>\n\n\n\n

GitHub Apps do not use OAuth tokens<\/strong> like traditional apps. Instead, they:<\/p>\n\n\n\n

    \n
  1. Authenticate as the App using a JWT (JSON Web Token)<\/strong>.<\/li>\n\n\n\n
  2. Exchange the JWT for an installation token<\/strong> for a specific installation<\/strong> of the app (per repo\/org).<\/li>\n\n\n\n
  3. Use the installation token<\/strong> to make authenticated API calls<\/strong> (REST or GraphQL).<\/li>\n<\/ol>\n\n\n\n
    \n\n\n\n

    \u2705 What Can You Do with an Installation Token?<\/h2>\n\n\n\n

    Once issued, an installation token:<\/p>\n\n\n\n

      \n
    • Acts on behalf of the GitHub App installation<\/strong><\/li>\n\n\n\n
    • Honors the app’s granted permissions and scopes<\/strong><\/li>\n\n\n\n
    • Is limited to specific repositories<\/strong> where the app is installed<\/li>\n\n\n\n
    • Expires in 1 hour<\/strong><\/li>\n<\/ul>\n\n\n\n
      \n

      Example: If your GitHub App is installed on octo-org\/repo-a<\/code> and repo-b<\/code>, your installation token can only access those, not others.<\/p>\n<\/blockquote>\n\n\n\n

      \n\n\n\n

      \ud83d\udee0\ufe0f How to Generate an Installation Token (Step-by-Step)<\/h2>\n\n\n\n

      Step 1: Generate a JWT (as the App)<\/h3>\n\n\n\n

      Use your app\u2019s private key:<\/p>\n\n\n

      const<\/span> jwt = require<\/span>('jsonwebtoken'<\/span>);\nconst<\/span> fs = require<\/span>('fs'<\/span>);\n\nconst<\/span> appId = 'YOUR_APP_ID'<\/span>;\nconst<\/span> privateKey = fs.readFileSync('private-key.pem'<\/span>);\n\nconst<\/span> token = jwt.sign(\n  {\n    iat<\/span>: Math<\/span>.floor(Date<\/span>.now() \/ 1000<\/span>),\n    exp<\/span>: Math<\/span>.floor(Date<\/span>.now() \/ 1000<\/span>) + (10<\/span> * 60<\/span>),\n    iss<\/span>: appId,\n  },\n  privateKey,\n  { algorithm<\/span>: 'RS256'<\/span> }\n);\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      \n\n\n\n
      Step 2: Get Installation ID<\/h3>\n\n\n\n
      Make a request using JWT to get installation ID:<\/p>\n\n\n
      GET \/app\/installations\nAuthorization: Bearer <JWT<\/span>><\/span>\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
      \n\n\n\n
      Step 3: Exchange JWT for Installation Token<\/h3>\n\n\n\n
      Use the installation ID from Step 2:<\/p>\n\n\n
      POST \/app\/installations\/:installation_id\/access_tokens\nAuthorization: Bearer <JWT<\/span>><\/span>\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
      Response:<\/strong><\/p>\n\n\n
      {\n  \"token\"<\/span>: \"v1.abc123...\"<\/span>,\n  \"expires_at\"<\/span>: \"2026-05-14T12:00:00Z\"<\/span>\n}\n<\/code><\/span>Code language:<\/span> JSON \/ JSON with Comments<\/span> (<\/span>json<\/span>)<\/span><\/small><\/pre>\n\n\n
      \n\n\n\n
      Step 4: Use Installation Token to Call GitHub API<\/h3>\n\n\n
      GET \/repos\/octo-org\/repo-a\/issues\nAuthorization: token v1.abc123...\n<\/code><\/span><\/pre>\n\n\n
      \n\n\n\n
      \ud83d\udd04 Installation Token vs OAuth Token<\/h2>\n\n\n\n
      Feature<\/th>Installation Token<\/th>OAuth Token<\/th><\/tr><\/thead>
      Acts as<\/td>GitHub App installation<\/td>Authenticated user<\/td><\/tr>
      Scope<\/td>Repo\/org installation<\/td>User\u2019s authorized scopes<\/td><\/tr>
      Use case<\/td>Automation, bots, CI\/CD<\/td>User-based access and interaction<\/td><\/tr>
      Expiry<\/td>1 hour<\/td>Long-lived unless revoked<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
      \n\n\n\n
      \ud83e\udde0 Example Use Cases<\/h2>\n\n\n\n
        \n
      • CI\/CD pipelines using GitHub Apps<\/li>\n\n\n\n
      • Auto-responders on issues\/pull requests<\/li>\n\n\n\n
      • Infrastructure automation (e.g., with Terraform)<\/li>\n\n\n\n
      • Custom bots interacting with GitHub<\/li>\n<\/ul>\n\n\n\n
        \n\n\n\n
        \ud83e\uddea Final Notes<\/h2>\n\n\n\n
          \n
        • You must use a JWT to request<\/strong> an installation token.<\/li>\n\n\n\n
        • Installation tokens cannot be refreshed<\/strong> \u2014 regenerate when expired.<\/li>\n\n\n\n
        • Use Octokit<\/strong> or Probot<\/strong> for easier abstraction.<\/li>\n<\/ul>\n\n\n\n
          <\/p>\n","protected":false},"excerpt":{"rendered":"
          A GitHub App Installation Token is a short-lived access token that allows a GitHub App to interact with specific repositories or organizations where it has been installed \u2014 on behalf… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[2],"tags":[],"class_list":["post-49321","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49321","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=49321"}],"version-history":[{"count":2,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49321\/revisions"}],"predecessor-version":[{"id":58971,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49321\/revisions\/58971"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=49321"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=49321"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=49321"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}