GitHub App Installation Tokens Are Now About 520 Characters. The Bugs Will Be in Your Redaction Rules

Wed, 07 Oct 2026 08:30:00 +0530

If a system of yours validates, stores, forwards or redacts GitHub App installation tokens, the format changed under it this year, and on November 30, 2026 the last switch for undoing that goes away. GitHub’s changelog for October 2 says the staged rollout that began on April 27 is complete. Newly minted installation tokens are now ghs_APPID_JWT, about 520 characters long instead of 40.

The part worth a closer look is not minting. Minting returns the token and your client carries on. The breakage lives in every place that holds the token afterwards, and the nastiest case does not throw.

Github on Kuldeep Pisda

GitHub App Installation Tokens Are Now About 520 Characters. The Bugs Will Be in Your Redaction Rules