- August 18, 2026 → GitHub Changelog — GitHub shipped token-type-specific credential revocation and deauthorization.
When Allison wrote the GitHub Changelog on August 18, she zeroed in on a problem every security team recognizes: the old “credential kill-switch” actions wiped all of a user’s credentials at once, forcing responders to choose between locking out a colleague entirely or leaving a breach open. “You can now take token-type and user-specific actions to deauthorize and revoke user credentials during a security incident,” Allison wrote. “This gives you finer-grained control when responding to a compromise.” GitHub Changelog
The shift is practical, not theoretical. Before August 18, enterprise owners and org admins who suspected a leaked personal access token had to destroy every credential a developer held — SSH keys, OAuth tokens, the lot. Now they can revoke a single credential type while leaving the rest intact, so legitimate access keeps working as the exposed tokens die. Allison noted the change covers personal access tokens, SSH keys, OAuth app tokens, and GitHub App user access tokens across the enterprise tier and the organization level through both the web UI and REST API GitHub Enterprise Cloud docs.
Allison explained that every action lands in the audit log and triggers an email to affected users — a paper trail auditors want, though one that also makes a mistaken bulk revocation visible to the people it disrupts. Enterprise owners and org admins now have a dedicated write_enterprise_credentials permission for the role, while OAuth tokens need the admin:enterprise scope to call the endpoint. Allison confirmed the change builds on GitHub’s earlier self-service credential revocation work, cautioning that “the sharper tool helps, though it is no replacement for knowing what you already have.” GitHub Changelog
Some security engineers, however, see a trade-off in the narrower blast radius. Revoking one credential type assumes the attacker only compromised that type; if a workstation is fully owned, the attacker may have already exfiltrated SSH keys and OAuth tokens alike, making partial revocation a false comfort. Critics also note that pushing the controls down to the organization level means more admins now hold a destructive power that once required enterprise-owner privileges, expanding the surface for both mistakes and insider abuse. Those concerns are real, yet the alternative — keeping the blunt all-or-nothing switch — left many teams frozen during actual breaches.
That cleanup problem keeps growing as agents and automations mint more tokens GitHub Copilot context handling.
