How to rotate GitHub tokens and deploy keys

GitHub has no grace period for tokens or deploy keys, so the overlap comes from holding two credentials at once. For a fine-grained personal access token, generate a new one with the same resource owner, repositories and permissions, move every consumer to it, and delete the old one. For a deploy key, add a second deploy key with a fresh key pair, switch the server to it, then delete the first. Both tokens or both keys work during the switch, so nothing breaks.

Crunu doesn't create, revoke or delete anything on GitHub. It points out which GitHub values a departing person could read, stores the new token or private key as a new environment version, and delivers it to the programs that use it.

Personal access tokens

GitHub prefixes every token with its type: github_pat_ for a fine-grained personal access token, ghp_ for a classic one, and ghs_ or ghu_ for GitHub App tokens (GitHub docs). GitHub recommends fine-grained tokens whenever possible. Each is limited to resources owned by a single user or organization, with permissions chosen one by one, while a classic token reaches every repository in every organization its user can access (managing tokens).

Facts that change how you plan a reissue:

• Approval can delay the switch. An organization can require approval for fine-grained tokens. Until an owner approves it, a new token is marked pending and can only read public resources. Get the approval before production depends on the token.
• Lifetime is your choice. Tokens without an expiration are allowed unless a maximum lifetime policy blocks them, and GitHub highly recommends setting one. An expired or revoked token can't be restored.
• GitHub revokes some tokens for you. A token pushed to a public repository or gist is revoked automatically, and so is one unused for a year (expiration and revocation).
• There is a ceiling. One account can create up to 50 fine-grained tokens. For organization automation, GitHub points to a GitHub App instead.

Reissue a token without downtime

Reissue a deploy key

A deploy key is an SSH key with access to exactly one repository, read-only unless you allowed write access. You can't reuse one key for several repositories, it has no expiry date, and the private half usually sits on a server without a passphrase (deploy keys). To replace one, generate a new pair, add the public key under the repository's Settings > Deploy Keys > Add deploy key, give the server the new private key, test a fetch, and delete the old deploy key.

ssh-keygen -t ed25519 -C "deploy web-app" -f ./web-app-deploy

If the private key lives in a Crunu environment, crunu pull puts it on the server with mode 0600. It refuses paths inside ~/.ssh/ unless you pass --allow-path for that run, so pick a path outside it or allow it explicitly.

What a departing developer still holds

This is where GitHub differs from most providers: the tokens are tied to the person's own account, which you don't control.

• Fine-grained tokens. Organization owners can view every fine-grained token that can reach organization resources and revoke its access. The token isn't deleted: it keeps read access to public resources, and SSH keys created by the token keep working. Its creator gets an email (reviewing tokens).
• Classic tokens. Owners can't revoke them from that page. Unless the organization restricts classic tokens, they reach organization resources until they expire.
• Deploy keys. They aren't linked to membership, so a deploy key the person added stays active after they're removed. And if a token was used to create a deploy key, deleting that token deletes the deploy key as well, so check before you delete a leaver's automation token.

In Crunu, removing the person yields a reissue checklist of the values they received, such as a shared bot token or a deploy private key. What to rotate when a developer leaves gives the full order of work, and the offboarding checklist builds the list for your stack. Reissuing on a schedule follows the same steps, and expiration dates make sure it actually happens.