Organization owners open Settings, then Personal access tokens, then Active tokens. The list shows fine-grained tokens that can reach the organization, with filters for owner, repository and permissions, and you can revoke one or many. Classic tokens do not appear there and work until they expire unless you restrict them.
Where to look
- Open your profile menu, choose Organizations, and pick the organization.
- Click Settings. If it is hidden, use the More menu.
- Under Personal access tokens, click Active tokens.
Click a token name to see its access and permissions. GitHub's page does not say the list shows last used or expiry dates, so do not assume you can find idle tokens from this screen alone.
Revoke one token or many
For a single token, open it, review the access and permissions, and click Revoke. For bulk work, apply filters, select the tokens, open the selected tokens menu and choose Revoke.
Two details matter. The creator gets an email when a token is revoked, so send your own note first to avoid surprise. And SSH keys created by a revoked token keep working, so review deploy and user keys separately.
What this view cannot see
The interface covers fine-grained tokens only. Classic tokens are not shown and can reach organization resources until they expire, unless your policy restricts them. A revoked token can still read public resources in the organization.
The REST endpoints for reviewing and revoking tokens can be called only by GitHub Apps, so a script run with a person's own token will not work. If you want a recurring report, build or install an app for it.
A review you can finish in an hour
- Filter by permissions and look first at tokens with write access to contents, workflows or administration.
- Filter by repository and check that tokens do not span far more repositories than their job needs.
- Ask each owner what the token is for. No answer means revoke it.
- Revoke, record the count and date, and note who approved.
- Then open the policy page and decide whether classic tokens should still be allowed.
Repeat quarterly. The first pass finds orphans, and later passes find drift. Keep the notes, since a dated token review is good access review evidence.
Where Safeguard fits
Safeguard scans dependencies and builds an SBOM, and its policies and gates can block a pull request that adds a known-vulnerable package. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Open the monitoring demo and look at how a recurring check keeps a list from going stale, the same idea as a quarterly token review.
Click through it at your own pace, or open it full screen.
Quick check
Will the owner of a revoked token be told?
Yes, GitHub sends the token's creator an email notification.
Does revoking remove SSH keys?
No. SSH keys created by a revoked token continue to work.
Sources
- Reviewing and revoking personal access tokens in your organization (GitHub Docs)
- Setting a personal access token policy for your organization (GitHub Docs)
Last reviewed: 19 October 2026.
