Request the fewest permissions the app needs, narrow each token to the repositories it must touch, keep the private key in a vault that can sign without exposing it, and verify every webhook signature. GitHub App installation tokens expire after one hour, which limits damage compared with a long lived personal token.
Why an app beats a shared token
A personal access token belongs to a person and usually carries that person's reach. A GitHub App has its own identity, its own permission list and tokens that expire. GitHub's documentation puts installation access tokens at one hour, expiring user access tokens at eight hours and refresh tokens at six months.
That makes apps a good home for bots that open pull requests, post comments or read repository metadata. When the person who built the integration leaves, the integration does not leave with them.
The practices GitHub recommends
| Area | Guidance |
|---|---|
| Permissions | Request only what the app needs |
| Token scope | Narrow tokens to fewer repositories when you create them |
| Private key | Store securely, prefer a key vault with sign only use, never hard code, never ship in client apps |
| Keys | Do not create more than needed, delete unused ones |
| Webhooks | Set a secret, verify each signature, subscribe only to needed events |
| Token reuse | Cache valid tokens rather than minting new ones constantly |
You can revoke an installation token early with the documented delete endpoint for installation tokens.
Common mistakes
- Requesting write access to everything because it was easier during development.
- Keeping the private key in an environment variable. The documentation notes that anyone who can read the environment can take the key.
- Skipping webhook signature checks because the endpoint URL is secret. URLs leak.
- Leaving old private keys active after rotation.
Review checklist for existing apps
- List installed apps and their permissions.
- Compare each permission with what the code uses. Drop what it does not.
- Check which repositories each installation covers.
- Confirm the key location and who can read it.
- Test that webhook signature verification rejects a bad signature.
- Assign an owner and a review date.
If an app cannot be scoped down, ask whether a smaller app per job would be easier to reason about.
Where Safeguard fits
Safeguard scans dependencies and builds an SBOM, and its policies and gates can block a pull request that adds a known-vulnerable package. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Open the setup demo to see how a tool connection is configured with limited scope, the same least privilege idea as an app.
Click through it at your own pace, or open it full screen.
Quick check
How long do installation tokens last?
One hour, according to GitHub's best practices page.
Is an environment variable fine for the private key?
The documentation says a vault that supports sign only use is preferable, since an attacker who reads the environment can take the key.
Sources
Last reviewed: 19 October 2026.
