On 26 March 2026 GitHub extended its credential revocation API to OAuth app tokens, GitHub App user tokens and GitHub App refresh tokens. Together with classic and fine-grained personal access tokens, that covers five token types. You can call it without being the owner, which makes it useful when you find someone else's token in a public repository, a log or a paste.
What's affected
The endpoint is POST /credentials/revoke. It accepts up to 1,000 credentials per request. The accepted prefixes are:
ghp_personal access token (classic)github_pat_fine-grained personal access tokengho_OAuth app access tokenghu_GitHub App user-to-server tokenghr_GitHub App refresh token
Installation tokens (ghs_) are not in that list. What happens on a valid hit, per GitHub:
- The token is revoked and the revocation is logged in the owner's security log.
- If the token had access to a GitHub organization, that access is removed immediately.
- The owner gets an email at their primary address.
- A revoked credential cannot be reactivated. The owner must generate a new one.
It is rate limited to 60 unauthenticated requests per hour. GitHub's reference says authenticated requests return a 403, so send the call without an Authorization header.
How to check if you're exposed
Search your own repositories, CI logs and ticket attachments for the prefixes above. For an organization, check the secret scanning alerts list as well.
git log -p --all -S'github_pat_' --oneline | head
What to do now
- Confirm the string is a real token format and not a test fixture. Do not paste it into chat or tickets while you check.
- Revoke it. Send the call with no authentication. The string below is GitHub's documentation example, so swap in the real one:
curl -L -X POST https://api.github.com/credentials/revoke \
-H "Accept: application/vnd.github+json" \
-d '{"credentials": ["ghp_1234567890abcdef1234567890abcdef12345678"]}'
A 202 means the request was accepted. A 422 means validation failed or the endpoint is being hit too often.
- If the token is yours, do not stop at revoking. List what it could reach, check the audit log for use between exposure and revocation, and replace it with a narrower credential. Our guide to moving off classic PATs covers the replacement.
- Clean the source, but know that deleting a file does not remove it from git history. Treat the string as burned.
- If the leak was an app private key or a cloud key, those are separate credentials. This API does not touch them, so rotate them in their own consoles.
Why it matters
Speed decides how much a leaked token is worth. Researchers and attackers both watch public event feeds, so a token in a public repository should be assumed copied. A call that anyone can make, and that also cuts organization access at once, closes that gap without waiting for the owner to wake up.
The API is a last resort for credentials you do not own. For your own, build the habit that revokes first and investigates second.
Quick check
Does the revocation API need an authenticated request?
No. GitHub's reference says it is unauthenticated and that authenticated requests return a 403.
Can the owner reactivate a revoked token?
No. Revoked credentials cannot be reactivated, so the owner must generate a new one.
