GitHub Apps Add Fine-Grained Permissions and Improved Management

What changed?

GitHub released several improvements to GitHub Apps permissions and management. Two new repository fine-grained permissions have been introduced: repository_creation:write and installation_repositories:write. These allow for more precise control than the previous repository_administration:write permission. The Add/Remove repository APIs now support both GitHub Apps and fine-grained PATs. GitHub Apps can now use the offline_access scope, enabling refresh tokens with expiring access tokens. The Get an app API can now fetch details about private and internal apps with shared ownership. App credentials are now managed in a dedicated Credentials tab. These changes are available in GitHub Enterprise Server (GHES) 3.24, except for offline_access, which is in GHES 3.23.

Why does it matter to an everyday developer?

These changes enable a least-privilege security model. Developers can now grant apps the ability to create repositories or manage installation repositories without exposing broader administrative access. This reduces the risk surface, helps organizations meet security policies, and allows repository administrators greater autonomy when adding approved apps. Offline_access support offers safer management and migration strategies for tokens. The streamlined credentials management makes app maintenance more reliable and prepares for upcoming workflow federation features.

What can the developer do now?

• Request only the new fine-grained permissions (repository_creation:write or installation_repositories:write) needed for your apps instead of broader admin access.
• Use the updated Add a repository to an installation API with GitHub Apps or fine-grained PATs for more precise repository control.