[metadata]
description: Your tokens can expire and can also be revoked by you, applications you have authorized, and GitHub itself.
google-site-verification: c1kuD-K2HIVF635lypcsWPoD4kilo5-jA_wBFyT4uMY
og:image: https://docs.github.com/assets/cb-345/images/social-cards/authentication.png
og:site_name: GitHub Docs
og:title: Token expiration and revocation - GitHub Enterprise Server 3.21 Docs
og:type: article
og:url: https://docs-internal.github.com/en/enterprise-server@3.21/authentication/keeping-your-account-and-data-secure/token-expiration-and-revocation
page-document-type: article
path-article: authentication/keeping-your-account-and-data-secure/token-expiration-and-revocation
path-language: en
path-product: authentication
path-version: enterprise-server@3.21
status: 200
twitter:card: summary
twitter:description: Your tokens can expire and can also be revoked by you, applications you have authorized, and GitHub itself.
twitter:domain: docs-internal.github.com
twitter:image: https://docs.github.com/assets/cb-345/images/social-cards/authentication.png
twitter:title: Token expiration and revocation - GitHub Enterprise Server 3.21 Docs
twitter:url: https://docs-internal.github.com/en/enterprise-server@3.21/authentication/keeping-your-account-and-data-secure/token-expiration-and-revocation
viewport: width=device-width, initial-scale=1

[document-links]
About 2FA: /en/enterprise-server@3.21/authentication/securing-your-account-with-two-factor-authentication-2fa/about-two-factor-authentication
About SSH: /en/enterprise-server@3.21/authentication/connecting-to-github-with-ssh/about-ssh
About passkeys: /en/enterprise-server@3.21/authentication/authenticating-with-a-passkey/about-passkeys
Access GitHub with 2FA: /en/enterprise-server@3.21/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication
Account security: /en/enterprise-server@3.21/authentication/keeping-your-account-and-data-secure
Activating optional features for GitHub Apps: /en/enterprise-server@3.21/apps/maintaining-github-apps/activating-optional-features-for-github-apps
Add a GPG key: /en/enterprise-server@3.21/authentication/managing-commit-signature-verification/adding-a-gpg-key-to-your-github-account
Add a new SSH key: /en/enterprise-server@3.21/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account
Agent failure to sign: /en/enterprise-server@3.21/authentication/troubleshooting-ssh/error-agent-admitted-failure-to-sign
Ask the GitHub community: https://github.com/orgs/community/discussions
Associate email with GPG key: /en/enterprise-server@3.21/authentication/managing-commit-signature-verification/associating-an-email-with-your-gpg-key
Authentication to GitHub: /en/enterprise-server@3.21/authentication/keeping-your-account-and-data-secure/about-authentication-to-github
Authentication: /en/authentication
Authentication: /en/enterprise-server@3.21/authentication
Blog: https://github.blog
Change 2FA method: /en/enterprise-server@3.21/authentication/securing-your-account-with-two-factor-authentication-2fa/changing-your-two-factor-authentication-method
Check for existing SSH key: /en/enterprise-server@3.21/authentication/connecting-to-github-with-ssh/checking-for-existing-ssh-keys
Check verification status: /en/enterprise-server@3.21/authentication/troubleshooting-commit-signature-verification/checking-your-commit-and-tag-signature-verification-status
Commit signature verification: /en/enterprise-server@3.21/authentication/managing-commit-signature-verification/about-commit-signature-verification
Configure 2FA recovery: /en/enterprise-server@3.21/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication-recovery-methods
Configure 2FA: /en/enterprise-server@3.21/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication
Contact support: https://support.github.com
Create a strong password: /en/enterprise-server@3.21/authentication/keeping-your-account-and-data-secure/creating-a-strong-password
Deploy keys: /en/enterprise-server@3.21/authentication/keeping-your-account-and-data-secure/reviewing-your-deploy-keys
Disable 2FA: /en/enterprise-server@3.21/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account
Displaying verification for all commits: /en/enterprise-server@3.21/authentication/managing-commit-signature-verification/displaying-verification-statuses-for-all-of-your-commits
Error: Bad file number: /en/enterprise-server@3.21/authentication/troubleshooting-ssh/error-bad-file-number
Error: Key already in use: /en/enterprise-server@3.21/authentication/troubleshooting-ssh/error-key-already-in-use
Error: Unknown key type: /en/enterprise-server@3.21/authentication/troubleshooting-ssh/error-unknown-key-type
Existing GPG keys: /en/enterprise-server@3.21/authentication/managing-commit-signature-verification/checking-for-existing-gpg-keys
Expert services: https://services.github.com
Generate new SSH key: /en/enterprise-server@3.21/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent
Generating a new GPG key: /en/enterprise-server@3.21/authentication/managing-commit-signature-verification/generating-a-new-gpg-key
GitHub Docs: /en/enterprise-server@3.21
Home: /en/enterprise-server@3.21
Learn how to contribute: /contributing
Make a contribution: https://github.com/github/docs/blob/main/content/authentication/keeping-your-account-and-data-secure/token-expiration-and-revocation.md
Manage personal access tokens: /en/enterprise-server@3.21/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens
Manage your passkeys: /en/enterprise-server@3.21/authentication/authenticating-with-a-passkey/managing-your-passkeys
Managing deploy keys: /en/enterprise-server@3.21/authentication/connecting-to-github-with-ssh/managing-deploy-keys
Managing your personal access tokens: /en/enterprise-server@3.21/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens
Permission denied (publickey): /en/enterprise-server@3.21/authentication/troubleshooting-ssh/error-permission-denied-publickey
Permission denied other-repo: /en/enterprise-server@3.21/authentication/troubleshooting-ssh/error-permission-to-userrepo-denied-to-userother-repo
Permission denied other-user: /en/enterprise-server@3.21/authentication/troubleshooting-ssh/error-permission-to-userrepo-denied-to-other-user
Pricing: https://github.com/pricing
Privacy policy: /en/site-policy/privacy-policies/github-privacy-statement
Privacy: /en/site-policy/privacy-policies/github-privacy-statement
REST API endpoints for OAuth authorizations: /en/enterprise-server@3.21/rest/apps/oauth-applications#delete-an-app-authorization
REST API endpoints for OAuth authorizations: /en/enterprise-server@3.21/rest/apps/oauth-applications#delete-an-app-token
Recover SSH key passphrase: /en/enterprise-server@3.21/authentication/troubleshooting-ssh/recovering-your-ssh-key-passphrase
Recover an account with 2FA: /en/enterprise-server@3.21/authentication/securing-your-account-with-two-factor-authentication-2fa/recovering-your-account-if-you-lose-your-2fa-credentials
Remove sensitive data: /en/enterprise-server@3.21/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository
Review security log: /en/enterprise-server@3.21/authentication/keeping-your-account-and-data-secure/reviewing-your-security-log
Reviewing and revoking authorization of GitHub Apps: /en/enterprise-server@3.21/apps/using-github-apps/reviewing-and-revoking-authorization-of-github-apps
Reviewing your SSH keys: /en/enterprise-server@3.21/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys
Reviewing your authorized OAuth apps: /en/enterprise-server@3.21/apps/oauth-apps/using-oauth-apps/reviewing-your-authorized-oauth-apps
Reviewing your security log: /en/enterprise-server@3.21/authentication/keeping-your-account-and-data-secure/reviewing-your-security-log
SSH agent forwarding: /en/enterprise-server@3.21/authentication/connecting-to-github-with-ssh/using-ssh-agent-forwarding
SSH key audit: /en/enterprise-server@3.21/authentication/troubleshooting-ssh/error-were-doing-an-ssh-key-audit
SSH key passphrases: /en/enterprise-server@3.21/authentication/connecting-to-github-with-ssh/working-with-ssh-key-passphrases
Security log events: /en/enterprise-server@3.21/authentication/keeping-your-account-and-data-secure/security-log-events
Sign in with a passkey: /en/enterprise-server@3.21/authentication/authenticating-with-a-passkey/signing-in-with-a-passkey
Signing commits: /en/enterprise-server@3.21/authentication/managing-commit-signature-verification/signing-commits
Signing tags: /en/enterprise-server@3.21/authentication/managing-commit-signature-verification/signing-tags
Status: https://www.githubstatus.com/
Sudo mode: /en/enterprise-server@3.21/authentication/keeping-your-account-and-data-secure/sudo-mode
Switching between accounts: /en/enterprise-server@3.21/authentication/keeping-your-account-and-data-secure/switching-between-accounts
Tell Git about your signing key: /en/enterprise-server@3.21/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key
Terms: /en/site-policy/github-terms/github-terms-of-service
Test your SSH connection: /en/enterprise-server@3.21/authentication/connecting-to-github-with-ssh/testing-your-ssh-connection
Token expiration: /en/enterprise-server@3.21/authentication/keeping-your-account-and-data-secure/token-expiration-and-revocation
Troubleshooting 2FA: /en/enterprise-server@3.21/authentication/securing-your-account-with-two-factor-authentication-2fa/troubleshooting-two-factor-authentication-issues
Unauthorized access: /en/enterprise-server@3.21/authentication/keeping-your-account-and-data-secure/preventing-unauthorized-access
Update access credentials: /en/enterprise-server@3.21/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials
Use verified email in GPG key: /en/enterprise-server@3.21/authentication/troubleshooting-commit-signature-verification/using-a-verified-email-address-in-your-gpg-key
Viewing and managing sessions: /en/enterprise-server@3.21/authentication/keeping-your-account-and-data-secure/viewing-and-managing-your-sessions
ssh-add "illegal option" error: /en/enterprise-server@3.21/authentication/troubleshooting-ssh/error-ssh-add-illegal-option----apple-use-keychain

[content]
Token expiration and revocation - GitHub Enterprise Server 3.21 Docs
Skip to main content
GitHub Docs
Version:
Enterprise Server 3.21
Search or ask Copilot
Search or ask
Copilot
Select language: current language is English
Search or ask Copilot
Search or ask
Copilot
Open menu
Collapse sidebar
Expand sidebar
Scroll breadcrumbs left
Home
Authentication
Account security
Token expiration
Scroll breadcrumbs right
Authentication
Account security
Authentication to GitHub
Create a strong password
Switching between accounts
Update access credentials
Manage personal access tokens
Reviewing your SSH keys
Deploy keys
Token expiration
Review security log
Security log events
Remove sensitive data
Sudo mode
Unauthorized access
Viewing and managing sessions
Secure your account with 2FA
About 2FA
Configure 2FA
Configure 2FA recovery
Access GitHub with 2FA
Change 2FA method
Troubleshooting 2FA
Recover an account with 2FA
Disable 2FA
Authenticate with a passkey
About passkeys
Manage your passkeys
Sign in with a passkey
Connect with SSH
About SSH
Check for existing SSH key
Generate new SSH key
Add a new SSH key
Test your SSH connection
SSH key passphrases
SSH agent forwarding
Managing deploy keys
Troubleshooting SSH
Recover SSH key passphrase
Permission denied (publickey)
Error: Bad file number
Error: Key already in use
Permission denied other-user
Permission denied other-repo
Agent failure to sign
ssh-add "illegal option" error
Error: Unknown key type
SSH key audit
Verify commit signatures
Commit signature verification
Existing GPG keys
Generating a new GPG key
Add a GPG key
Tell Git about your signing key
Associate email with GPG key
Signing commits
Signing tags
Displaying verification for all commits
Troubleshoot verification
Check verification status
Use verified email in GPG key
Token expiration and revocation
Your tokens can expire and can also be revoked by you, applications you have authorized, and GitHub itself.
Copy as Markdown
In this article
Token revoked after reaching its expiration date
Token revoked by the user
Token revoked by the OAuth app
Token revoked due to excess of tokens for an OAuth app with the same scope
User token expired due to GitHub App configuration
When a token has expired or has been revoked, it can no longer be used to authenticate Git and API requests. It is not possible to restore an expired or revoked token, you or the application will need to create a new token.
This article explains the possible reasons your GitHub token might be revoked or expire.
Note
When a personal access token, OAuth app token, or GitHub App token expires or is revoked, you may see an
oauth_authorization.destroy
action in your security log. For more information, see
Reviewing your security log
.
Token revoked after reaching its expiration date
When you create a personal access token, we recommend that you set an expiration for your token. Upon reaching your token's expiration date, the token is automatically revoked. For more information, see
Managing your personal access tokens
.
Token revoked by the user
You can revoke your authorization of a GitHub App or OAuth app from your account settings which will revoke any tokens associated with the app. For more information, see
Reviewing and revoking authorization of GitHub Apps
and
Reviewing your authorized OAuth apps
.
Once an authorization is revoked, any tokens associated with the authorization will be revoked as well. To reauthorize an application, follow the instructions from the third-party application or website to connect your account on GitHub again.
Token revoked by the OAuth app
The owner of an OAuth app can revoke an account's authorization of their app, this will also revoke any tokens associated with the authorization. For more information about revoking authorizations of your OAuth app, see
REST API endpoints for OAuth authorizations
.
OAuth app owners can also revoke individual tokens associated with an authorization. For more information about revoking individual tokens for your OAuth app, see
REST API endpoints for OAuth authorizations
.
Token revoked due to excess of tokens for an OAuth app with the same scope
There is a limit of ten tokens that are issued per user/application/scope combination, and a rate limit of ten tokens created per hour. If an application creates more than ten tokens for the same user and the same scopes, GitHub revokes one of the existing tokens with the same user/application/scope combination, chosen in this order:
The oldest token that has never been used.
If every token has been used, the token that was least recently used.
Hitting the hourly rate limit will not revoke your oldest token. Instead, it will trigger a re-authorization prompt within the browser, asking the user to double check the permissions they're granting your app. This prompt is intended to give a break to any potential infinite loop the app is stuck in, since there's little to no reason for an app to request ten tokens from the user within an hour.
User token expired due to GitHub App configuration
User access tokens created by a GitHub App will expire after eight hours by default, and then must be regenerated using the included refresh token. Owners of GitHub Apps can optionally configure these tokens to never expire instead, but this is not recommended due to the security implications. For more information about configuring your GitHub App's user access tokens, see
Activating optional features for GitHub Apps
.
Help and support
Did you find what you needed?
Yes
No
Privacy policy
Help us make these docs great!
All GitHub docs are open source. See something that's wrong or unclear? Submit a pull request.
Make a contribution
Learn how to contribute
Still need help?
Ask the GitHub community
Contact support
Legal
©
2026
GitHub, Inc.
Terms
Privacy
Status
Pricing
Expert services
Blog
